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Abstract 

We study lower bounds for quantum distributed network computing, where a set of nodes (rep- 
resenting quantum computers) interconnected by an underlying network consisting of (bandwidth- 
restricted) quantum communication links, communicate using quantum communication. We 
show non-trivial time lower bounds of quantum distributed algorithms for fundamental graph 
problems. Our bounds are strong in the sense that they hold even when nodes have unlimited 
computational power and share an unlimited number of entangled qubits. Our bounds hold for 
many fundamental graph verification problems as well as for various graph optimization prob- 
lems (both exact and approximate optimization). Our lower bounds are shown in a uniform way 
by showing a connection between quantum communication complexity and quantum distributed 
computing and hence gives a general technique for showing lower bounds for a wide variety of 
distributed network problems in the quantum setting. 

For many graph verification problems, we show a tight two-sided error quantum lower bound 
of Q(y/n) time, where n is number of nodes in the network (Q(x) hides poly log x). Our lower 
bounds match the previous classical deterministic algorithms and even subsume the previously 
known lower bounds in the classical distributed computing model [Das Sarma et al., STOC 11, 
Peleg and Rubinovich, FOCS 99, Elkin STOC 04]. In particular, our quantum lower bounds 
for the Hamiltonian cycle and spanning tree verification problems imply a new bound also in 
the classical setting which answers an open problem in [Das Sarma et al., STOC 11]. They 
are also the first randomized lower bounds for both graph problems, subsuming the previous 
deterministic lower bounds [Das Sarma et al., STOC 11]. We then show a £l(mm(W/a, y/n))- 
time lower bound (W is the ratio between the maximum and minimum edge weights in the graph) 
for any ^-approximation quantum distributed algorithm for many graph optimization (both exact 
and approximate) problems such as minimum spanning tree, shortest path tree, minimum cut etc. 
In particular, our bound for the classical minimum spanning tree problem, besides generalizing 
the bound in [Das Sarma et al., STOC 11] to the quantum setting, also improves the previous 
bound even in the classical setting, and is the first bound that is tight for all values of W as it 
matches previous deterministic upper bounds [Elkin, STOC 04]. 

To prove our quantum lower bounds, we introduce a new communication model called the 
server model which seems to be a key model that captures the hardness of quantum distributed 
networks. This model is a generalization of the standard two-party (Yao's communication com- 
plexity) model and lower bounds on this model imply lower bounds on the two-party model and 
quantum distributed network model. We prove quantum lower bounds in the server model, some 
of which also imply new lower bounds in the two-party model for problems such as Hamiltonian 
cycle and spanning tree, even in the classical setting. We extend our study to the gap version of 
the graph verification problems, which is a key to get tight lower bounds for all values of W. We 
show a tight one-sided error lower bound of the gap- Hamiltonian cycle, gap-spanning tree, and 
gap- connectivity problem which might be of independent interest. 
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1 Introduction 

This paper concerns the marriage of two major computer science areas: distributed network com- 
puting and quantum computing. The power and limitations of distributed/decentralized network 
computation has been studied intensively over the last three decades or so. In a distributed net- 
work, each individual node can directly communicate only with its neighboring nodes. Despite being 
restricted to such local communication, the network itself should work towards a global task, e.g., 
broadcast a piece of data, elect a (global) leader, construct a spanning tree or a minimum spanning 
tree (MST), construct a shortest path tree (SPT) or efficient routing paths between node pairs. 
Indeed, such fundamental primitives underlie the operation of modern communication networks. 

Quantum computing, on the other hand holds the promise to fundamentally change the way we 
do computing. Quantum computing and distributed computing might enter a mutually beneficial 
partnership. On the one hand, it may be easier to build a number of small quantum computers 
and connect them distributively rather than build a single large one (which seems quite difficult 
under current technology). On the other hand, some of the fundamental problems in distributed 
computing could potentially be solved more efficiently by taking advantage of the superior resources 
and processing power that quantum mechanics offers. This paper focuses on this second aspect, 
namely studying the power of distributed network computation augmented with quantum effects. 

Some distributed tasks can be solved entirely via local communication, for instance, how many 
friends of friends one has. Classic combinatorial optimization problems such as maximl matching, 
coloring, dominating set, vertex cover, or approximations thereof are considered "local" problems, 
as they can be shown to be solved using small (i.e., polylogarithmic) local communication (e.g., 
see [5U EHl [62] ) . However many important optimization problems (e.g., those listed in the above 
paragraph) are "global" problems from the distributed computation point of view. To count the 
total number of nodes, to elect a leader, to compute a spanning tree, a MST or a SPT, information 
necessarily must travel to the farthest nodes in a system. If exchanging a message over a single 
edge costs one time unit, one needs ft(D) time units to compute the result, where D is the network 
diameter. If message size was unbounded, one can simply collect all the information in O(D) time, 
and then compute the result. However, in many applications, there is bandwidth restriction on the 
size of the message (or the number of bits) that can be exchanged over a communication link in one 
time unit. This motivates studying global problems in the £>-model (also commonly known as the 
CONGEST(B) model [SI]), where each node can exchange at most B bits (typically B is small, say 
O(logn)) among its neighbors in one time step. This is one of the central models in the study of 
distributed computation. The design of efficient algorithms for the £>-model (in the classical setting), 
as well as establishing lower bounds on the time complexity of various fundamental distributed 
computing problems, has been the subject of an active area of research called (locality-sensitive) 
distributed computing for the last three decades (see [54J and references therein). In particular, 
extensive research has been done in studying upper and lower bounds on distributed algorithms for 
various fundamental graph optimization and verification (both exact and approximate) problems 
(e.g., see [HI SHI ESI EQl ESI 1251 EQl EH EH1 E2] and the work of [H] and the references therein). 

The main focus of the current work is to understand the time complexity of fundamental global 
problems in the £>-model in the quantum setting, where nodes can use quantum processing and can 
communicate over quantum links using quantum bits and can use exclusively quantum phenomena 
such as entanglement (e.g., see [TTl H ES] ) . In a recent work ([H]) it was shown that many important 
graph verification and optimization problems in the £>-model in the classical setting have a time 
lower bound of f2(^/n), where n is the number of nodes in the distributed network. (Note that this 
bound holds even in a network of small (O(logn)) diameter.) The present work significantly extends 
and generalizes the above result and shows that the same time lower bound essentially holds for 
the quantum setting as well for various important graph verification and optimization problems. To 
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prove our main result, we develop new techniques that relate quantum communication complexity 
lower bounds to quantum distributed computing lower bounds. Our techniques are general and can 
be used to derive non-trivial lower bounds for a wide variety of distributed network problems in the 
quantum setting. 

Organization of the paper In Section [2] we define the quantum distributed network model 
used in this paper. For the sake of readability, this is first done informally, while rigorous formal 
definitions are presented in Part II of the Appendix. In Section [3] we discuss the role of quantum 
effects in distributed computing, especially in relation to local and global problems, and mention 
other work that relates quantum and distributed computing. In Section [4] we state the graph 
problems considered in this paper. Section [5] states our main technical results — our lower bound 
theorems for graph verification and optimization problems as well as some additional new lower 
bounds results in quantum communication complexity. Full proofs for all our theorems are given in 
the Appendix (Parts I and II). Section [6] gives an overview of our proof ideas and techniques used. 
We conclude in Section [7] with some open problems. 

2 Distributed Computing Model 

Consider a synchronous network of processors modeled by an undirected n- vertex graph, where nodes 
model the processors and edges model the links between the processors. The processors (henceforth, 
nodes) communicate by exchanging messages via the links/channels (edges). The vertices have 
limited global knowledge, in particular, each of them has its own local perspective of the network 
(a.k.a. graph), which is confined to its immediate neighborhood. The nodes may have to compute 
(cooperatively) some global function of the graph, such as a spanning tree (ST) or a minimum 
spanning tree (MST), via communicating with each other and running a distributed algorithm 
designed for the task at hand. 

There are several measures to analyze the performance of such algorithms, a fundamental one 
being the running time, defined as the worst-case number of rounds of distributed communication. 
This measure naturally gives rise to a complexity measure of problems, called the time complexity. 
We assume the £>-model, mentioned above: In each round at most B bits can be sent through each 
edge in each direction, where B is the bandwidth parameter of the network. 

In the standard distributed computing literature (e.g., see [5U HU [65] ) , the usual model consid- 
ered is the classical deterministic model where nodes (representing classical processors) communicate 
using classical bits and the algorithms used by nodes are deterministic. An additional resource in 
the classical setting that makes algorithms more powerful is randomness. In the private randomness 
model, each node has an access to an infinite random string. A seemingly more powerful model is 
the shared randomness model where nodes have access to an infinite shared random string. 

In the quantum setting, a distributed network could be augmented with two additional resources: 
quantum communication and entanglement (see e.g., [32]). Quantum communication allows nodes 
to communicate with each other using quantum bits (qubits). Entanglement allows nodes to possess 
qubits that are entangled with qubits of other nodes. For example, a well-known entangled state on 
two qubits is the EPR pair [191 S] which is a pair of qubits that, when measured, will either both be 
zero or both be one, with probability 1/2 each. An EPR pair shared by two nodes can hence be used 
to, among other things, generate a shared random bit for the two nodes. Assuming entanglement 
implies shared randomness (even among all nodes), but also allows for other operations such as 
quantum teleportation [51], which replaces quantum communication by classical communication 
plus entanglement. Quantum communication and entanglement resources are known to help saving 
communication in some cases, as will be illustrated later (cf. Example 3.1 in Section [5]). 

Quantum distributed networks can be categorized based on which resources are assumed. In 
this paper, we are interested in the most powerful model where both quantum communication and 
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entanglement are assumed. In a quantum distributed network with n nodes we allow the nodes to 
share an arbitrary n-partite entangled state that does not depend on the input. For instance, every 
pair of nodes could share some EPR-pairs, and all n nodes together could share instances of the 
superposition (l/\/2)(|0 n ) + |l n )) in order to simulate a global public coin. To put it differently, we 
allow the most general form of shared entanglement as long as it does not reveal anything about 
the problem inputs. Throughout the paper, we simply refer to this model as quantum distributed 
network (or just distributed network, if the context is clear). All lower bounds we show in this paper 
hold in this model, and thus imply lower bounds in weaker models as well. 

3 The Role of Quantumness in Local and Global Problems 

Lower bounds for local problems (e.g., maximal independent set [37J), where the running time is 
usually O (poly log n), in the quantum setting usually directly follow from the same arguments as in 
the classical setting. This is because these lower bounds are proved using the "limited sight" argu- 
ment: The nodes do not have time to get the information of the entire network. Since entanglement 
cannot be used to replace communication (by, e.g., Holevo's theorem [27J (also see [5TJ [50])), the 
same argument holds in the quantum setting with prior entanglement. This argument is captured 
by the notion of physical locality defined by Gavoille et al. [26] , where it is shown that for many 
local problems, quantumness does not give any significant speedup in time compared to the classical 
setting. 

The above argument, however does not seem to be extendible to global problems where the 
running time is usually fl(D) where D is the diameter of the network. In this setting, the argument 
developed in the line of work in [14] (which follows the line of work in [55j BTl [22j [35]) can be used to 
show tight lower bounds of many problems in the classical setting. However, this argument does not 
always hold in the quantum setting. The main reason is that this argument essentially relies on the 
"congestion" argument: Nodes cannot communicate fast enough (due to limited bandwidth) to get 
important information to solve the problem. However, we know that the quantum communication 
and entanglement can potentially decrease the amount of communication and thus there might be 
some problems that can be solved faster. To illustrate this point, consider the following contrived 
example where we solve the set disjointness problem. 

Example 3.1. Suppose we give 6-bit string x and y to node u and v in the network, respectively, 
where b = \fn. We want to check whether the inner product (x,y) is zero or not. This is called 
the Set Disjointness problem (Disj). It is easy to show that it is impossible to solve this problem 
in less than D/2 rounds since there will be no node having the information from both u and v if 
u and v are of distance D apart. This is the very basic idea of the limited sight argument. (We 
note that the real argument to prove natural problems are sometimes much more complicated than 
this, see, e.g., [33 [361 EE].) This argument holds for both classical and quantum setting and thus 
we have a lower bound of Q(D) on both settings. This lower bound, in fact, can be improved to 
fl(b) = Q(y/n) in the classical setting, even when the network has diameter O(logn). This follows 
from the communication complexity of fi(6) of Disj [2] [29l [3l [59] and the Simulation Theorem of 
|14| . This lower bound, however, does not hold in the quantum setting since we can simulate the 
known O(Vb) -communication quantum protocol (PQ) in O(VbD) = 0{{n) l ^D) rounds. 

Thus we have an example where quantum communication gives an advantage over classical 
communication. A fundamental question is: "Does this phenomenon occur for natural distributed 
network problems?" In this paper we show that, for many global graph problems, the lower bounds 
that hold for the classical setting also hold in the quantum setting. In particular, for the well- 
studied distributed MST problem, our results show that quantumness does not give any advantage 
compared to the classical setting. 
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Other Related Work While our work focuses on solving graph problems in quantum distributed 
networks, there are several prior works focusing on other distributing computing problems (in- 
cluding communication complexity in Yao's two-party or multiparty communication model) using 
quantum effects. We note that fundamental distributed computing problems such as leader election 
and byzantine agreement have been shown to solved better using quantum phenomena (see e.g., 
[T7]). It has been shown that leader election in anonymous networks can be solved using quantum 
communication even without pre-shared entanglement |644 I17j; in the classical setting this is im- 
possible. In [5j, it has been shown that byzantine agreement against a dynamic adversary can be 
solved more efficiently using quantum communication. Entanglement has been used to reduce the 
amount of communication of a specific function of input data distributed among 3 parties [12] (see 
also the work of [9] on multiparty quantum communication complexity) . Many related results of the 
above scenario are discussed in [15l[63j. As of now no separation between quantum and randomized 
communication complexity is known in the so-called number-on-the-forehead multiparty model, in 
which players' inputs overlap. 

There are several results showing that quantum communication complexity in the two-player 
model can be more efficient than classical randomized communication complexity, see for instance 
[TUt [56] . These results also easily extend to the so-called number-in-hand multiparty model (in 
which players have separate inputs). Other papers relating quantum and distributed computing are 
IS], HB, E3], [31], pj, and [21]. 

4 Graph Problems 

Graph problems in the quantum distributed network model Our main interest is on two 
types of graph problems: optimization and verification problems. In both types of problems, we 
are given a distributed network N modeled by a graph and some property V such as "Hamiltonian 
cycle" , "spanning tree" or "connected component" . 

In optimization problems, we are additionally given a (positive) weight function w : E(N) —> R+, 
and our goal is to find a subnetwork M of N of minimum weight that satisfies V (e.g. minimum 
Hamiltonian cycle or minimum spanning tree) where every node knows which edges incident to it 
are in M. Algorithms sometimes depend on a parameter W defined as W — maXe££; W w \ e \ . 

^ mm eE£;(A0 w(e) 

In verification problems, we are additionally given a subnetwork M of N (each node knows which 
edges incident to it are in M). We want to determine whether M has some property, e.g., M is 
Hamiltonian cycle (Ham(TV)), a spanning tree (ST(7V)), or connected component (Conn(iV)). M is 
to be considered as the input to the problem we are trying to solve. 

We use QV^ci (Ham (TV)) to refer to the quantum time complexity of Hamiltonian cycle verification 
problem on network N where for any 0-input M (i.e. M is not a Hamiltonian cycle), the algorithm 
has to output zero with probability at least 1 — eo and for any 1-input M (i.e. M is a Hamiltonian 
cycle), the algorithm has to output one with probability at least 1 — e\. (We call this type of 
algorithm (eo, e\)- error.) When eo = e\ — e, we simply write Q*' iV (Ham(iV)). Define Qt£ ei (ST(N))) 
and (3*o 5ei (Conn(7V)) similarly. 

We also study the gap versions of verification problems. For any integer 5 > 0, property V and 
a subnetwork M of iV, we say that M is S-far from V if we have to add at least S edges from N and 
remove any number of edges in order to make M satisfy V . For example, M is 5- far from being a 
Hamiltonian cycle if we have to add at least 6 edges from N to M and remove any number of edges 
in order to make M a Hamiltonian cycle. We denote the problem of distinguishing between the case 
where the subnetwork M satisfies V and 5-far from satisfying V the 5-V problem (it is promised 
that the input is in these two cases). When we do not want to specify 5, we write Gsp-V. 
Graph problems in the communication complexity model To avoid confusion, we also 
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define graph problems on the communication complexity model here. Let G be a graph of n nodeq^j 
We partition edges of G to Ea(G) and Eb(G). Alice and Bob are given a set of edges Ea(G) and 
Eb(G), respectively. They want to determine whether G has some property, e.g., G is a Hamiltonian 
cycle (Ham n )[^J a spanning tree (ST n ), or is connected (Conn n ). For the purpose of this paper in 
proving lower bounds of distributed algorithms, we restrict that Ea(G) and Eb(G) are perfect 
matchings in the case of the Hamiltonian cycle problem. 

We let Q*o^ei (Pn) denote the communication complexity in the quantum setting with entangle- 
ment of graph property V on n-node input graph where for any z-input (an input whose correct 
output is i) the algorithm must output i with probability at least 1 — e^. We simply write QV cc (Vn) 
instead of Qt]T{Vn)- For a closely related model called the server model (defined in Section [6]), we 
use Qp server (V n ) to denote the communication complexity. 

We also consider the gap version in the case of communication complexity. The notion of 5-far 
is slightly different in that we can add any edges to G instead of adding only edges in N to M as 
in the case of distributed network [^J For example, we say that G is 5 -far from being a Hamiltonian 
cycle if we have to add at least 6 edges and remove any number of edges in order to make G a 
Hamiltonian cycle. We define the notion of 5-far spanning tree and connected component similarly. 

We mention the reason behind our complexity notations. First, we use * as in Q* in order to 
emphasize that our lower bounds hold even when there is a prior entanglement, as usually done in 
the literature. Since we deal with different models in this paper, we put the model name after *. 
Thus, we have Q* ,cc for the case of two-party communication complexity model, Q*' server for the 
case of server model, and Q* ,N for the case of distributed algorithm on a distributed network N. 

5 Our Main Technical Results 

Our main results are non-trivial lower bounds of quantum algorithms for fundamental graph prob- 
lems on distributed networks. Our bounds hold even when nodes in the networks share an unlimited 
number of entangled qubits and approximated answers are allowed. Our specific results for verifi- 
cation and optimization graph problems are as follows. 

1. Verification problems We prove a tight two-sided error quantum lower bound of ^(y^) 
time, where n is the number of nodes in the distributed network and ®{x) hides poly log x, for the 
Hamiltonian cycle and spanning tree verification problems. Our lower bound holds even in a network 
of small (O(logn)) diameter. 

Theorem 5.1 (Verification Lower Bound). For any B and large n, there exists e > and a B- 
model n-node network N of diameter O(logn) such that any (e,e)-error quantum algorithm with 
prior entanglement for Hamiltonian cycle, and spanning tree verification problems on N requires 
n (^B^i) Ume - Thatis > Qe* liV (Ham(iV)) and Q* e ' N (ST (N)) are 

Our bound implies a new bound on the classical setting which answers the open problem in 
[2], and is the first randomized lower bound for both graph problems, subsuming the deterministic 
lower bounds of Hamiltonian cycle verification [14] . spanning tree verification [14] and minimum 

1 To avoid confusion, throughout the paper we use G to denote the input graph in the communication complexity 
model and N and M to denote the distributed network and its subnetwork, respectively, unless specified otherwise. 
For any graph if, we use V(H) and E(H) to denote the set of nodes and edges in if, respectively. 

2 Ham n is used for the Hamiltonian cycle verification problem in the communication complexity model, where n 
denotes the size of input graphs, and Ham (N) is used for the Hamiltonian cycle verification problem on the distributed 
network model, where N denotes the network we are considering. 

3 We note that the notion of 5-far should not be confused with the notion of e-far usually used in property testing 
literature where we need to add and remove at least e fraction of edges in order to achieve a desired property. The 
two notions are closely related. The notion that we chose makes it more convenient to reduce between problems on 
different models. 
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Previous results 


Our results 


S-model 
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Ham, ST, MST verifica- 
tion 


Q(s/n/B log n) deterministic, 
classical communication p~4j 135] 


n( y/n/B log n) two-sided error, 
quantum communication with 
entanglement 


Conn and other verifica- 
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Q(y/n/ Blogn) two-sided error, 
classical communication [T4] 
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problems 
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^(min( v / n, W/a)/y/B log n) 
Monte Carlo, quantum commu- 
nication with entanglement 


communication 
complexity 


Ham, ST, and other verifi- 
cation problems 


Q(n) one-sided error, classical 
communication [57] 


Q(n) two-sided error, quantum 
communication with entangle- 
ment 


Gap-Ham, Gap-ST, Gap- 
Conn, and other gap prob- 
lems for Q(n) gap 


unknown 


Q(n) one-sided error, quantum 
communication with entangle- 
ment 



Figure 1: Previous and new lower bounds. We note that n is the number of nodes in the network in the case 
of distributed network and the number of nodes in the input graph in the case of communication complexity. 



spanning tree verification [35]. It is also shown in [14] that Ham can be reduced to several problems 
via deterministic classical-communication reductions. Since these reductions can be simulated by 
quantum protocols, we can use these reductions straightforwardly to show that all lower bounds in 
[H] hold even in the quantum setting. 

Corollary 5.2. For any B and large n, there exists e > and a B-model n-node network N of 
diameter O(logn) such that any (e,e)-error quantum algorithm with prior entanglement for the 



following verification problems on N requires ^(y Blogn ) ^ me: Connected component, minimum 
spanning tree, spanning connected subgraph, cycle containment, e-cycle containment, bipartiteness, 
s-t connectivity, connectivity, cut, edge on all paths, s-t cut and least- element list. 



We refer to Section 12.2 for definitions. Fig. [T] compares our results with previous results for 



various verification problems. 

2. Optimization problems We show a tight Q(mm(W/a, ^/n))-time lower bound for any a- 
approximation quantum randomized (Monte Carlo) distributed algorithm for the MST problem. 

Theorem 5.3 (Optimization Lower Bound). For any n, B, W and a <W there exists e > and a 
B-model Q(n)-node network N of diameter 0(log n) such that any e-error a -approximation quantum 
algorithm with prior entanglement for computing the minimum spanning tree problem on N with 
weight function w : E(N) -> R + such that ^ ^[n) w(e) — ^ requires ^( y / B \ ogn mm(W/a, y/n)) 
time. 

Our results generalize the bounds in [H] to the quantum setting. Moreover, this lower bound, 
when restricted to the classical communication setting, improves the bound of [14J for the case 
of small W and matches the deterministic upper bound of Q(mm(W/a,yN)) resulting from a 
combination of Elkin's ^-approximation 0(W/a)-time deterministic algorithm [22] and Peleg and 
Rubinovich's 0(y/N)-time exact deterministic algorithm [[25| PTC] in the classical communication 
model. Thus it is the first bound that is tight for all values ofW. Fig. [2] compares our lower bounds 
with previous lower bounds. 

Again, using the same reduction as in [13] , our bound also implies that all lower bounds in [13] 
hold even in the quantum setting. 
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Time T(n, W) 




O(Vn) (Kutten-Peleg PODC'95) 



W = ®(ay[n) 

W = 0(cm) 



fl(Vn) (DasSarmaetalSTOC'll) 



Figure 2: Previous and our bounds for approximating the MST problem in distributed networks when N and 
a are fixed. The dashed line (in red) represents the deterministic upper bounds (Algorithms). The dotted 
line (in red) is the previous lower bound of randomized (Monte Carlo) algorithms. The solid line (in black) 
represents the bounds shown in this paper. Note that the previous lower bounds hold only in the classical 
setting while the new lower bounds hold in the quantum setting even when entanglement is allowed. See 



Theorem 5.3 and Corollary 5.4 for the full statements 



Corollary 5.4 (Main results for optimization problems). For any n, B, W and a there exists e > 
and a B -model Q(n)-node network N of diameter O(logn) such that any e-error a -approximation 
quantum algorithm with prior entanglement for computing the following problems on N with weight 
function w : E(N) -> R + such that m^ 6 ^^ T(e j — ^ requires ^( ^/ B \ ogn mm(W/a, y/n)) time: 
minimum spanning tree, shallow-light tree, s-source distance, shortest path tree, minimum routing 
cost spanning tree, minimum cut, minimum s-t cut, shortest s-t path and generalized Steiner forest. 



We refer to Section 12.2 for definitions of the above optimization problems. 
5.1 Additional results: Communication complexity lower bounds 

In proving the main results, we prove some new lower bounds in the two-party quantum commu- 
nication complexity model. In fact our bounds hold for a slightly stronger model called the server 
model, which will be introduced in Section |6j 

First, we show a tight bound of the Hamiltonian cycle in the two-sided error quantum setting 
on n-node input graphs. 

Theorem 5.5. For any n and some e > 0, (5*' cc (Ham n ) = Q(n) . 

To the best of our knowledge, this the first two-sided error lower bounds of Ham n even in the 
classical setting (nondeterministic (thus one-sided error) lower bounds are previously known [57J). 
As a corollary, we immediately get lower bounds for many other verification problems. Of these the 
lower bound for Spanning tree is new, whereas the bounds for Bipartiteness and s-t connectivity 
follow from a reduction from Inner Product given in [2], and a lower bound for Connectivity was 
recently shown in |28j (but does not show hardness of Hamiltonian cycle) . 

Corollary 5.6. For any n and some e > 0, Q*' cc (P n ) = £l(ri), where P n can be any of the following 
verification problems: spanning tree, connectivity, s-t connectivity, and bipartiteness. 

We also extend our study to the gap version of the graph verification problems in the one-sided 
error setting via a reduction from recent lower bounds in [32J . 

Theorem 5.7. For any n, some constants e, (3 > 0, QQ C e c ((f3n) — Ham n ) = Q(n). 
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Figure 3: Our proof structure. Lines in gray show the implications of our results in communication complexity. 



We note that in proving the above theorem we observe lower bounds of the gap version of Set 
Disjointness and Equality. As before, the theorem implies lower bounds of other problems. 

Corollary 5.8. For any n, some constants e,/3 > 0, Qq^ c ((/3ti) — P n ) = Q(n), where P n can be any 
of the following verification problems: spanning tree, connectivity, s-t connectivity and bipartiteness. 

6 Overview of Technical Approach 

The high-level idea behind our lower bound proofs is by establishing a connection between quantum 
communication complexity and quantum distributed network computing. Our work is inspired by 
|14| (following a line of work in [55j Wf\ |22( |35j) which shows lower bounds of many graph verifica- 
tion and optimization problems in the classical distributed computing model. The main technique 
used to show the classical lower bounds in [H] is the Simulation Theorem (cf. Theorem 3.1 in 
[H]) which shows how one can use lower bounds for problems in the standard two-party (Yao's) 
classical communication complexity model [40] to derive lower bounds of equivalent problems in the 
"distributed" version of communication complexity. Specifically, the Simulation Theorem relates 
the communication lower bound from the standard two-party communication complexity model to 
compute some appropriately chosen function / (e.g., Set Disjointness or Equality) to the distributed 
time complexity lower bound for computing the same function in a specially chosen graph G. They 
use a graph that was first used in [55J. The Simulation Theorem effectively reduces the task of 
proving lower bounds of graph verification problems to merely picking the right function / to re- 
duce from. Two functions that were used in p3] were Set Disjointness and Equality, which are 
quintessential problems in the world of communication complexity [40J . Finally, one can reduce the 
verification problem to hardness of distributed approximation for a variety of problems to show that 
the same lower bounds hold for approximation algorithms as well. Our starting point for show- 
ing lower bounds for the quantum setting is a question whether there is a quantum version of the 
Simulation Theorem, i.e., whether one can prove quantum distributed algorithm lower bounds via 
quantum (two-party) communication complexity lower bounds. However, this seems challenging to 
do due to several difficulties (as explained below); in fact, it leads us to a proof that is substantially 
different compared to the classical setting. In particular, while we cannot prove a "quantum" Sim- 
ulation Theorem using the standard two-party model, we manage to identify a new communication 
model called the server communication model and prove a server model version of the Simulation 
Theorem. Our new Simulation Theorem shows that the server model captures the hardness of 
distributed algorithms well in both the classical and quantum setting. We then show that many 
important bounds in the standard quantum two-party model also hold in the server model. Some 
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of the bounds we prove are even new in the standard model and classical setting. These bounds 
together with our new Simulation Theorem lead to our main results. Details are as follows. 
Where the Simulation Theorem Fails and the Server Model Saves Us The first difficulty 
in extending previous techniques is that is it not clear whether the Simulation Theorem holds in the 
quantum setting (i.e., whether a quantum two-party communication complexity implies a distributed 
algorithm lower bound). The main reason is that its proof seems to require the two players, say Alice 
and Bob, to simulate some common nodes in a network. While this is easy to do in the classical 
setting, it is not clear whether it is still possible in the quantum setting. 

To illustrate this point, let us introduce a new model called the server model. There are three 
players in the server model, Carol, David and the server. Carol and David receive the inputs x and 
y, respectively, and want to compute f(x,y) for some function /. As in the two-party model, Carol 
and David can talk to each other. Additionally, they can talk to the server. The catch here is that 
the server can send messages for free. Thus, the communication complexity in the server model 
counts only messages sent by Carol and David. This model, even without prior entanglement, is 
clearly at least as strong as the standard quantum communication complexity model with shared 
entanglement, since the server can dispense any entangled state to Carol and David. 

With the server model in our perspective, we can refine the previous connection between two- 
party communication complexity and distributed algorithm lower bound (i.e., the Simulation The- 
orem) to two separate connections: (1) A connection between the two-party and server models and 
(2) A connection between the server model and distributed networks. We will show that the second 
connection holds even in the quantum setting with entanglement: 



Theorem 6.1 (Details in Section 10). For any B, L,T > logL ; (3 > and eo, e\ > 0, there exists a 



B -model quantum network N of diameter (log L) and@(TL) nodes such that ifQt^ ((/3r)-Ham(iV)) < 
\ - 2 then Q^ e e r er ((/3r)-Ham r ) = 0((ElogL)Q e ^ 1 ((^r)-Ham(iV))). 

This theorem is similar to the Simulation Theorem in [TJj except that it replaces the standard 
two-party model by the server model. Our proof follows from previous techniques [55 } Wf \ [22 | 135 } H^ l 
H9] (e.g., we use a similar graph and maintain the state of similar sets of nodes) but also provides 
some simplification (e.g., we reduce from graph problems directly, leaving most of the "hard part" 
in the communication complexity model, and we do not require simulating common nodes which is 
a source of confusion). This proof also shows that the underlying idea of this technique is in fact 
the same as the simple idea of bisection width commonly used in distributed networking as well as 
other areas (see, e.g., gQl El ESS E5]). 

Now we know that the second connection holds even in the quantum setting. Thus, to prove 
the quantum version of the Simulation Theorem, it remains to show that the server-model commu- 
nication complexity is lower bounded by the two-party communication complexity. We note that 
it is clear that the converse is true: the communication complexity of the server model is at most 
the two-party model in both classical and quantum settings since Carol and David can pretend to 
be Alice and Bob. On the other hand, it is conceivable the two models are equivalent: Since the 
server does not get any input, he seems to act only as a channel. Are these two models equivalent? 
A partial answer to this question leads to one of the difficulties in the quantum setting: While it is 
easy to prove that the two models are equivalent in the classical setting, it is not clear if they are in 
the quantum setting. 

To explain some issues in the quantum setting, let us sketch the proof of this in the classical 
setting. Let us first consider the deterministic setting. The proof is by the following "simulation" 
argument. Alice will simulate Carol and the server. Bob will simulate David and the server. In each 
round, Alice will see all messages sent from the server to Carol and thus she can keep simulating 
Carol. However, she does not see the message sent from David to the server which she needs to 
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simulate the server. So, she must get this message from Bob. Similarly, Bob will get from Alice the 
message sent from Carol to the server. These are the only messages we need in each round in order 
to be able to simulate the protocol. Observe that the total number of bits sent between Alice and 
Bob is exactly the number of bits sent by Carol and David to the server. Thus, the complexities 
of both models are exactly the same in the deterministic case. We can conclude the same thing for 
the public coin setting (where all parties share a random string) since Alice and Bob can use their 
shared coin to simulate the shared coin of Carol, David and the server. 

The above argument, however, does not seem to work in the quantum setting. The main issue 
with a simulation along the lines of the one sketched above is that Alice and Bob cannot simulate a 
"copy" of the server each. For instance one could try to simulate the server's state in a distributed 
way by maintaining the state that results by applying CNOT to every qubit of the server and a 
fresh qubit, and distribute these qubits to Alice and Bob. But then if the server sends a message to 
Carol, Bob would have to disentangle the corresponding qubits in his copy, which would require a 
message to Alice. 

While we leave as an open question whether the two models are equivalent in the quantum 
setting, we prove that many lower bounds in the two-party model extend to the server model. 
Server-model Communication Complexity (Details in Section [8] and [9]) In this paper we 
show lower bounds of two types of problems. The first type consists of basic problems studied in 
the standard two-party model such as Equality and Set Disjointness. To show lower bounds of these 
problems, we show a connection between the server model and nonlocal games. Nonlocal games are 
games where Alice and Bob receive an input x and y from some distribution and want to compute 
f(x,y). However, they cannot talk to each other. Instead, they output one bit, say a and 6, which 
are then combined to be an output. For example, in XOR games and AND games, these bits are 
combined as a © b and a A 6, respectively. The players' goal is to maximize the probability that the 
output is f(x,y). We relate nonlocal games to the server model by showing that the XOR- and 
AND-game players can use an efficient server-model protocol to guarantee a good winning chance. 

Lemma 6.2 (Details in SectionlS]). For any boolean function f and eo, e\ > 0, there is an XOR-game 

9/0* i server ( f\ 

strategy A and AND-game strategy A such that, for any input (x, y), with probability 4 Ve o> e i W ; 
A! and A! f output f(x,y) with probability at least 1 — Cf( x ,y)> otherwise A! outputs and 1 with 
probability 1/2 each, and A 1 ' outputs with probability 1. 

Following the 72-norm techniques in [60l S3] and the recent method of [32], we show one- and 
two-sided error lower bounds of many problems on the server model, which match the two-party 
model lower bounds. 

The second type of problems are graph problems. To show a lower bound of Hamiltonian cycle 
verification (Ham n ), we derive reductions (using some novel gadgets) from Inner Product mod 3 
(IPmod3 n ) and Gap Equality (Gap-Eq n ), defined in Section[8j This result also implies a lower bound 
for spanning tree (ST n ) verification. (We note again that the lower bounds of Ham n and ST n are 
new even in the classical two-party model.) Using the server- model communication complexity of 
Ham n and Gap-Ham n , we can show lower bounds of distributed algorithms as discussed earlier. 
Fig. [3] depicts our proof strategy. 

7 Conclusion 

In this paper, we derive the first non-trivial lower bounds for important network problems in a 
quantum distributed network. Our approach gives a uniform and powerful way to prove lower 
bounds for various problems. Using our approach it might be possible to prove lower bounds for 
other problems or possibly strengthen existing lower bounds for problems such as shortest path and 
minimum cut (which are not tight at present). Other interesting open problems are: (1) Can we 
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derive a "Quantum" two-party version of the Simulation Theorem? In other words, can we relate 
distributed algorithm lower bounds to the two-party quantum communication complexity model 
instead of the server model? This will be very helpful as it can simplify the proofs by using existing 
bounds in the two-party model. (2) Finally, it will be interesting to explore upper bounds in the 
quantum setting as well: Do quantum distributed algorithms help in solving fundamental graph 
problems such as shortest path and minimum cut? 
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Appendix 

Part U: Proofs 



In this part, we explain our proofs at a high level. Some details are postponed to Part \U\ for 
readability. This part is organized as follows (also see Fig. [3]). In Section [8] we show server-model 
lower bounds of two basic problems in communication complexity called Inner Product mod 3 and 
Gap-Equality. In Section [9j we show server-model lower bounds of the Hamiltonian cycle problem 
and its gap version by reducing from the above mentioned two basic problems. In Section [TUJ we 
prove a quantum version of the Simulation Theorem which shows that a server-model lower bound 



implies a quantum distributed network lower bound. Finally in Section [TT] we combine the results 
to show our main theorems. 

8 Server-Model complexity of IPmod3 n and Gap-Eq n 

In this section we prove lower bounds of the following problems. In the Inner Product mod 3 problem 
(denoted by IPmod3 n ), Carol and David are given n-bit strings x and y respectively. They have to 
output 1 if (Y^i=i x %Vi) mod 3 = and otherwise. In the Gap Equality problem with parameter S 
(denoted by 5-Eq n ), Carol and David also receive n-bit strings x and y. Additionally, it is promised 
that either x = y or the hamming distance between x and y, denoted by A(x,y) is more than 5, 
i.e. \{i I X{ ^ yi}\ > S. In the former case, they have to output 1; otherwise they have to output 0. 
Details of this section such as formal definitions and proofs can be found in Section [T3} 



Theorem 8.1. For some /3,e > and any large n, Qp server (IPmod3 n ) and QQ S e erver ((f3n)-Eq n ) are 

Our proof makes use of the relationship between the server model and nonlocal games. In such 
games, Alice and Bob receive input x and y from some distribution tt that is known to the players. 
As usual they want to compute a boolean function f(x,y) such as Equality or Inner Product mod 
3. However, they cannot communicate to each other. Instead, each of them can send one bit, say 
a and 6, to a referee. The referee then combines a and b using some function g to get an output 
of the game g(a,b). The goal of the players is to come up with a strategy (which could depend 
on distribution tt and function g) that maximizes the probability that g(a,b) = f(x,y). We call 
this the winning probability. One can define different nonlocal games based on what function g the 
referee will use. Two games of our interest are XOR- and AND-g&mes where g is XOR and AND 
functions, respectively. 

Our proof follows the framework of proving two-party quantum communication complexity lower 
bounds via nonlocal games (see, e.g., [121 HH1 [32]). The main modification is the following lemma 
which shows that the XOR- and AND-game players can make use of an efficient server-model 
protocol to guarantee a good winning probability. 

Lemma 8.2. For any boolean function f and 60, e\ > 0, there is an XOR-game strategy A! and 
AND-game strategy A! f such that, for any input {x,y), with probability 4 -2( ^ e o> e i (f\ A! and A" 
output f(x,y) with probability at least 1 — €f( x ,y)> otherwise A! outputs and 1 with probability 1/2 
each, and A" outputs with probability 1. 

Proof Sketch. We prove the lemma in a similar way to the proof of Theorem 5.3 in |l2] (attributed 
to Buhrman). Let A be any (eo, ei)-error server- model protocol with communication complexity T. 
We will construct A 1 and A" that simulate A. First we simulate A with an additional assumption 
that there is a "fake server" that sends messages in the nonlocal games, but the two players in the 
games (Alice and Bob) do not send any message to the fake server. Later we will eliminate this fake 
server. We will refer to parties in the server model as Carol, David and the real server. 
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Using teleportation (see, e.g., [51]), it can be assumed that Carol and David send 2T classical 
bits to the real server instead of sending T qubits (the server can set up the necessary entanglement 
for free). Assume that, on an input (x,y), Carol and David send bits c± and dt in the t th round, 
respectively. (We note one detail here that in reality c± and dt, for all £, are random variables. We 
will ignore this fact here to illustrate the main idea.) 

Now, Alice, Bob and the fake server generate shared random strings a\. . .a t and b\ ... b t (this 
can be done since their states are entangled). These strings serve as a "guessed" communication 
sequence of A. Alice, Bob and the fake protocol simulate Carol, David and the real protocol, 
respectively. However, in each round t, instead of sending bit c t that Carol sends to the real server, 
Alice simply looks at a t and continues playing if her guessed communication is the same as the real 
communication, i.e. c t = a t . Otherwise, she "aborts": In the XOR-game protocol Al she outputs 
and 1 with probability 1/2 each, and in the AND-game protocol A!' she outputs 0. Bob does the 
same thing with dt and bt- 

The fake server simply assumes it receives at and bt and continues sending messages to Alice and 
Bob. Observe that the probability of never aborting is 4 _T (i.e., when the random strings a\ . . . 
and b\. . .bp are the same as the communication sequences c\ . . . ct and d\ . . . dy, respectively). If 
no one aborts, Alice will output Carol's output while Bob will output in XOR-game protocol A 1 
and 1 in AND-game protocol A". If no one aborts, Alice, Bob and the fake server perfectly simulate 
A and thus output f(x,y) with probability at least 1 — Cf( x ,y) m both protocols. Otherwise (with 
probability at most 1 — 4 _T ) one or both players will abort and the output will be randomly and 
1 in A! and in A!' . This is exactly what we claim in the theorem except that there is a fake server. 

Now we eliminate the fake server. Notice that the fake server never receives anything from Alice 
and Bob. Hence we can assume that the fake server sends all his messages to Alice and Bob before 
the game starts (before the input is given), and those messages can be viewed as prior entanglement. 
We thus get standard XOR- and AND-game strategies without a fake server. □ 



Now we sketch the proof of Theorem 8.1, To show that Q e ' (IPmod3 n ) = fi(n), we use an 



XOR-game strategy A! and eo = e\ — e from Lemma 8.2 Using this we can extend the theorem of 
Linial and Shraibman [16] from the two-party model to the server model and show that Qp server (f) 
is lower bounded by an approximate 72 norm: Qp server (f) = fi(log72 6 (Aj)) for some matrix Af 



defined by /. (See Lemma 13.2 in Section 13 for detail. 



Using / = IPmod3 n , one can then extend the proof of Lee and Zhang [43 ; Theorem 8] to lower 



bound approximate 72 norm by an approximate degree of some certain functions f (see Lemma 13.4 



in Section 13 for detail), and follow the proof of Sherstov [60J and Razborov [58J to finally prove 
that 

Q*,server^p mod3n) = f2(lo g T | e ( A| Pmod3 „ ) ) = J2(deg 2e (/')) = «(n). 

We note that this technique actually extends all lower bounds we are aware of on the two-party 
model to the server model (e.g. those in [58 } 160 } H3]). 

To prove that s e erver ((f3n)-Eq n ) = Q(n) for some /3, e > 0, we use an AND-game strategy A" 
with eo = and e\ = e = 1/2 from Lemma |&2| We adapt a recent result by Klauck and de Wolf 
[32] . which shows that Qq^C/O — fool 1 (/) — l)/2. Here fool 1 (/) refers to the 1-fooling set size 
of /, which is defined as follows. A 1-fooling set for / is a set F = {(x, y)} of input pairs with the 
following properties. 

• If (x,y)eF then f(x,y) = l 

• If (:r, y), (x', y f ) e F then f(x, y') = or f(x f , y) = 

The lower bound in [32J actually applies to AND-games as follows. Suppose Alice and Bob 
receive inputs x, y, perform local measurements on a shared entangled state, and output bits a, b. 
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Xj = xi = 1 



y* = o 



Figure 4' The construction of gadget G^. If = then Alice adds dashed thin edges (in red); otherwise she 
adds solid thin edges (in red). If yi = then Bob adds dashed thick edges (in blue); otherwise he adds solid 
thick edges (in blue). (See Fig. [5] for pictures of G{ for all possible values of xi and y^.) 



Then the probability that a A b = 1 for a uniformly random x,y E F is at most l/fool 1 (/), if the 
probability that a A b = 1 for x, y with y) = is always 0. 

Lemma |8.2| for the case of AND-games implies that there is an AND-game strategy A" such 
that if f(x,y) = then A" always output and if f(x,y) = 1 then A" outputs 1 with probability 

r.^*, server / n\ Q ^* , server / n\ ^ 

at least (1 - e)4 2 ^ u> . This implies that (1 - e)4 u> < l/fool^/). In other words, 

if fool^/) = then Q^ er {f) = fi(n). 

All that remains is to define a good fooling set for (/3n)-Eq n . Fix any 1/4 > /3 > 0. The 
idea is to use a good error-correcting code to construct the fooling set. Let A(x,y) denote the 
Hamming distance. Let C be a set of n-bit strings such that the Hamming distance between any 
distinct x, y G C is at least 2f3n. Due to the Gilbert- Varshamov bound such codes C exist with 
\C\ > 2( 1 ~ H ( 2 ^ n = 2^ n \ where H denotes the binary entropy function. Hence we can conclude 



that Q 



0,1/2 



(03n)-Eq n ) = n(n). 



9 Server-model communication complexity of Ham r 

This section is devoted to proving the following theorem. 



Theorem 9.1. 

are Cl(n). 



For any n and some constants e, /3 > ; Q 



*,server 



(Ham n ) and Q*^ s e erver {{[3n)-Y\ar(\ r 



We first sketch the lower bound proof of (3*' se ™ er (Ham n ) and show later how to extend to the 
gap version. More detail can be found in Section [TIJ We will show that for any < e < 1 and some 
constant c, Q* ,seruer (IPnriod3 n ) = 0(Q*' ser ^ er (Hanri cn )). The theorem then immediately follows from 



the fact that Qe Server 



= Q(n) (cf. Theorem |8.1[) 

••Vn 



Let x = x\ . . . x n and y = y\ . . . y n be the input of IPmod3 n . We construct a graph G which is 
an input of Ham cn as follows. The graph G consists of n gadgets, denoted by Gi, . . . , G n . For any 
1 < i < n — 1, gadgets G{ and Gi+i share exactly three nodes denoted by v^vj,vf. Each gadget 
Gi is constructed based on the values of X{ and yi as outlined in Fig. [I| The following observation 
can be checked by drawing Gi for all cases of xi and yi (as in Fig. [5]). 

Observation 9.2. For any value of (xi,yi), Gi consists of three paths where v\_ x is connected by 



a path to v, 



(j+Xi-yi) mod 3 



, for any < j < 2. Moreover, Alice's (respectively Bob's) edges, i.e. thin 



(red) lines (respectively thick (blue) lines) in Fig. Q form a matching that covers all nodes except 
v\ (respectively vj_i) for all < j < 2. 
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Figure 5: Gadget Gi for different values of X{ and j/j. The main observation is that if x» • yt =0 then G{ 
consists of paths from v{_ 1 to v{ for all < j < 2. Otherwise, it consists of paths from vj_ 1 to v^ +1 ^ mod 3 . 




Figure 6: The graph G consists of gadgets Gi,...G n - The solid thick edges (in gray) linking between v 3 
and v 3 n , for < j < 2 represent the fact that v 3 = v 3 n . Lines that appear in each gadget Gj depicts what we 
observe in Observation |9.2| solid thin lines (in red) represent paths that will appear in Gi if xi ■ yi = 0, and 
dashed thick lines (in blue) represent paths that will appear in Gi if Xi ■ yi = 1. 
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Thus, when we put all gadgets together, graph G will consist of three paths connecting between 
nodes in {^o}o<j<2 on one side and nodes in {^n}o<j<2 on the other. How these paths look like 
depend on the structure of each gadget G{ which depends on the value of x\ • yi. The following 



lemma follows trivially from Observation 9.2 



Lemma 9.3. G consists of three paths P° ; P 1 and P 2 where for any < j < 2, P J has v J as one 

7 , 7 (j + T,l<i<n X i-yi) m ° d3 ,7 ,7 

end vertex and v n — as the other. 



Now, we complete the description of G by letting v J Q = v J n for all 
< j < 2. It then follows that G is a Hamiltonian cycle if and only if 

in Section 



mod 3/0 (see Fig. pi also see Lemma 14.3 and Fig. 



14). Thus we can check that J2i<i< n x i ' Vi 
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mod 3 is zero or 



not by checlang whether G is a Hamiltonian cycle or not. Theorem |9.1 



'i-l 




now follows from Theorem 18.11 

To show a lower bound of Q*^ erver ((/3n)-Ham n ) , we reduce from ((3n)- 
Eq n in a similar way using gadget G{ shown in Fig. [7| For any 1 < i < 



n— 1, gadget G{ and Gi+i share vf and 
It is straightforward to show that if x 
and if X{. ^ yi, for some i\ < %2 < 



vj , and we let Vq 



and v, 



o 



V/ = 



Xi = 1 



Vy 



y then G is a Hamiltonian cycle 
. < is then G will consists of 5 



Figure 7: Gadget G^. 



We note that our reduction 



cycles where each cycle starts at gadget G{. and ends at gadget Gi j+1 . 
also gives a simplification of the rather complicated reduction in [TH Section 6] . 

10 From Server- Mo del to £>-Model Lower Bounds 

In this section, we show that in the quantum setting, a server-model lower bound implies a £>-model 
lower bound, as in the following theorem. 

Theorem 10.1. For any B, L, T > logL, f3 > and eo,ei > ; there exists a B-model quantum 
network N of diameter O(logL) and ®(TL) nodes such that if QV^ei ((/?r)-Ham(iV)) <\ — 2 then 



Q^erver {m _ Hamr) 



0((BlogL)g e *^ 1 ((/3r)-Ham(iV))). 



In words, the above theorem states that if there is an (eo, ei)-error quantum distributed algo- 
rithm that solves the Hamiltonian cycle verification problem on N in at most (L/2) — 2 time, i.e. 
Qto^ei (Ham(TV)) < (L/2)— 2 , then the (eo, ei)-error communication complexity in the server model of 
the Hamiltonian cycle problem on T-node graphs is Qto,el ver (Hamr) = 0((B log L)Q*^ ei (Ham(iV))) . 
The same statement also holds for its gap version. We note that the above theorem can be extended 
to a large class of graph problems with some certain properties. We state it for only Ham for 
simplicity. 



Proof idea of Theorem \10.1\ We give the proof idea here and provide full detail in Section [T5} Al- 
though we recommend the readers to read this before the full proof and believe that it is enough to 
reconstruct the full proof, this proof idea can be skipped without loss of continuity. 

We note again that the main idea of this theorem essentially follows the ideas developed in 
a line of work in [551 E2 S3 EE E]. In particular, we construct a network following ideas in 
[55J [221 SZl [351 E] , an d our argument is based on simulating the network by the three players of the 
server model. This idea follows one of many ideas implicit in the proof of the Simulation Theorem in 
P3] which shows how two players can simulate some class of networks. However, as we noted earlier, 
the previous proof does not work in the quantum setting, and it is still open whether the Simulation 
Theorem holds in the quantum setting. We instead use the server model. Another difference is 
that we prove the theorem for graph problems instead of problems on strings (such as Equality or 
Disjointness). This leads to some simplified reductions since reductions can be done easier in the 
communication complexity setting. 
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Figure 8: The network N' used in the proof idea of Theorem 



10.1 



with sets S f n and St 



To explain the main idea, let us focus on the non-gap version of Hamiltonian cycle verification 
and consider a £> -model network N f consisting of T paths, each of length L, where we have an edge 
between any pair of the leftmost (respectively, rightmost) nodes of paths, as shown in Fig. [8j Now 
we will prove that if Qt^ei (Ham(iV)) < (L/2) — 2 then Q*o^™ er (Hamr) = (i.e. no communication 
is needed from Carol and David to the server!). Note that this statement is much stronger than the 
theorem statement but it is not desirable since N f has diameter 0(L) which is too large. We will 
show how to modify N f to get the desired network N later. 

Let paths in N f be P 1 , . . . , P v and nodes in path P l be v\, . . . , v l L . Let A be an (eo, ei)-error 
quantum distributed algorithm that solves the Hamiltonian cycle verification problem on network 
N (Ham(Af)) in at most (L/2) - 2 time. 

We show that Carol, David and the server can solve the Hamiltonian cycle problem on a T-node 
input graph without any communication, essentially by "simulating" A on some input subnetwork 
M corresponding to G = {U,Ec U Ed) in the following sense. When receiving Eq and Ed, the 
three parties will construct a subnetwork M of N' (without communication) in such a way that 
M is a Hamiltonian cycle if and only if G = (U,Eq U Ed) is. Next, they will simulate algorithm 
A in such a way that, at any time t and for each node v % - in TV', there will be exactly one party 
among Carol, David and the server that knows all information that v l - should know in order to run 
algorithm A, i.e., the state of v l - as well as the messages (each consisting of B quantum bits) sent 
to Vj from its neighbors at time t. The party that knows this information will pretend to be v l - and 
apply algorithm A to get the state of v % - at time t + 1 as well as the messages that v % - will send to 
its neighbors at time t + 1. We say that this party owns v % - at time t. Details are as follows. 

Initially at time t = 0, we let Carol owns all leftmost nodes, and David owns all rightmost nodes 
while the server owns the rest, i.e. Carol, David and the server own the following sets of nodes 
respectively (see Fig. [8]): 

S° c = {v\\l<z<T}, 5g, = {4|l<i<r}, S° S = V(N')\(S° C US° D ). (1) 

After Carol and David each receive a perfect matching, denoted by Eq and Ed respectively, on 
the node set U = {^1, . . . ,^r}, they construct a subnetwork M of N f as follows. For any i ^ j, 
Carol marks v\v{ as participating in M if and only if U{Uj E Eq- Similarly, David marks v l L v J L as 
participating in M if and only if U{Uj E Ed- The server marks all edges in all paths as participating 
in M. Fig. [9] shows an example. We note the following observation which relies on the fact that Eq 
and Ed are perfect matchings. 
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Figure 9: The subnetwork M when the input perfect matchings are Ec = {(^1, ^2), (^3, ^4), • • • , (^r-i, ^r)} 
and Ed = {(^2, ^3), (^4, ^5), • • • , (^r, ^1)} (subnetwork M consists of all bold edges). 



Observation 10.2. The number of cycles in G — (U, Ec^JEd) is the same as the number of cycles 
in M. 

Now the three parties start a simulation. Recall that at time t — the three parties own nodes 
in the sets S^, Sp and S$ as in Eq.Q. Our goal it to simulate A for one time step and make sure 
that Carol, David and the server own the following sets respectively (see Fig. [8]): 

sh = {v\,vi\i<i<r}, 5i, = {4_ 1 ,4|i<i<r} ) si = v(N')\ (shush). (2) 

To do this, the parties simulate A on the nodes they own for one time step. This means that each 
of them will know the states and out-going messages at time t = 1 (i.e., after A is executed once) 
of nodes they own. Observe that although Carol knows the state of v\, for any z, at time t = 1, she 
is not able to simulate A on v\ for one more step since she does not know the message sent from 
v\ to v\ at time t = 1. This information is known by the server who owns v\ at time t — 0. Thus, 
we let the server send this message to Carol. Additionally, for Carol to own node v\ at time t = 1, 
it suffices to let the server send the state of v\ and the message sent from v\ to v\ at time t — 1 
(which are known by the server since it owns v\ and v\ at time t = 0). The messages sent from the 
server to David can be constructed similarly. It can be checked that after this communication the 
three parties own nodes as in Eq.Q and thus they can simulate A for one more step. 

Using a similar argument as the above we can guarantee that at any time t < (L/2) — 2, Carol, 
David and the server own nodes in the following sets respectively: 

sh = {v) 1 1 < i < r, 1 < j < t + 1}, S^ = {v) 1 1 < i < r, L - t < j < L}, S| = V(N') \ (Sh U S f D ) 

Thus, if algorithm A terminates in (L/2) — 2 steps then Carol, David and the server will know 
whether M is a Hamiltonian cycle or not with (eg, ei)-error by reading the output of nodes they 



own. By Observation 10.2, they will know whether G — (J7, Ec U Ed) is a Hamiltonian cycle or not 
with the same error bound. 

Now we modify N f to get network N of small diameter. A simple idea to slightly reduce the 
diameter is to add a path having half the number of nodes of other paths and connect its nodes to 



every other node on the other paths (see path H 1 in Fig. 10). This path helps reducing the diameter 
from L to roughly (L/2) — 2 since any pair of nodes can connect in roughly (L/2) — 2 hops through 
this path. By adding about O(logL) such paths (with H l having half the number of nodes of H 1-1 ) 



as in Fig. 10, we can reduce the diameter to O(logL). We call the new paths highways. 

We can use almost the same argument as before to prove the theorem, by modifying sets Sq, S f D 



and S f s appropriately as in Fig. 10 and consider the input graph G = (U, Ec U Ed) of V + k nodes, 
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Figure 10: The network N which consists of network N' and some "highways" which are paths with nodes 
kj (i.e., nodes in blue). Bold edges show an example of subnetwork M when the input perfect matchings 
are E c = {(u u u 2 ), (u 3 ,u A ), . . . , (ur+k-i,v> r +k} and E D = {(u 2 ,u 3 ), (u^u 5 ), . . . , (u r +fc,ui)}. Pale edges are 
those in N but not in M. 



where k is the number of highways. The exception is that now Carol and David have to speak a 
little. For example, observe that if the three parties want to own the states of Sq, and S$ at 
time t = 1, Carol has to send to the server the messages sent from node h\ to its right neighbor, for 
all i. Since this message has size at most B and the simulation is done for Qto,a (Ham(TV)) steps, 
Carol will send 0(( J Blogn)(5*o^ 1 (Ham(A^))) qubits to the server. David will have to send the same 
amount of information and thus the complexity in the server model is as claimed. □ 

11 Proof of main theorems 
11.1 Proof of Theorem 



5.1 



Theorem 11.1 (Theorem |5.1| restated). For any B and large n, there exists e > and a B- 
model n-node network N of diameter O(logn) such that any (e,e)-error quantum algorithm with 
prior entanglement for Hamiltonian cycle, and spanning tree verification problems on N requires 
n(Jmk^) tme - That is, Qtf (Ham(iV)) and Q* e f (ST(iV)) are Q(J^^) . 



Proof We note from Theorem |9.1| that 

g e *'™ r (Ham r ) > cT (3) 



for some e > and d > 0. Let c be the constant in the big-Oh in Theorem 
and T = \\/Bnlog n] . Assume that 

j 



10.1 



Q:;f(Ha m( iV))<L/2<-^— . (4) 
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By Theorem 10.1, there is a network ./V of diameter O(logL) = O(logn) and Q(LF) — 6(n) nodes 
such that 

Q*'! erver (Ham r ) < (cB log L)Q*f (Ham (JV)) 



< (cB log L)(f/ " 



2c y £>logn 



< c! yjBnlog 



n 



where the second equality is by Eq. Q. This contradicts Eq.Q, thus proving that Q e ]e (Ham (AT)) > 

— TcJ Blogn' 



To show a lower bound of Q*,'i V (ST(7V)), let .4 be an algorithm that solves spanning tree ver- 
ification on N in T4 time. We can use A to verify if a subnetwork M is a Hamiltonian cycle as 
follows. First, we check that all nodes have degree two in M (this can be done in O(D) time). If 
not, M is not a Hamiltonian cycle. If it is then M consists of cycles. Now we delete one edge e in 
M arbitrarily, and use A to check if this subnetwork is a spanning tree. It is easy to see that this 
subnetwork is a spanning tree if and only if M is a Hamiltonian cycle. The running time of our 
algorithm is T A + 0{D). The lower bound of Q*'f (Ham(TV)) implies that T A = Sl(J^n-). □ 



11.2 Proof of Theorem 



5.3 



Theorem 11.2 (Theorem |5.3| restated) . For any n, B, W and a <W there exists e > and a B- 
model Q(n)-node network N of diameter 0(logn) such that any e-error a -approximation quantum 
algorithm with prior entanglement for computing the minimum spanning tree problem on N with 
weight function w : E(N) —> R + such that < W requires Q( -^=3=== mm(W/a, y/n)) 

time. 



Proof We note from Theorem |9.1| that 

Q* o: s £ erver ((/3r)-Ham r ) > cT (5) 

for some constant /3 > 0, e > and d > 0. Let c be the constant in the big-Oh in Theorem |10.1| 
Let L = l Cy /gi ogn min(^, y/n)\ an d T = \y/B lognmax(^, y/n)~\. We prove the following claim 
the same way we prove Theorem |5.1| in the previous section. 



Claim 11.3. QS;f((/3r)-Ham) > f > £ mm(W/a, ^J^) 
Proof. Assume that 



as? iiw-i < § < ^ -w, X^i . (6) 



By Theorem 10.1, there is a network N of diameter O(logL) = O(logn) and Q(LT) = Q(n) nodes 
such that 

Q*,server {m _ Hamr) < (cB logL) Q^ ((/8r) . H am) 

< (cB log L)(L/2) 

c'^/Blo^ . W ^ 

< o mln( - — ' V n ) 

z a 

^ c'-v/B logn .net * — . 

< g max ^' 

<cT 
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where the second equality is by Eq. ^ and the fourth inequality is because if ^ < ^Jn then 
a > W r /\/n and thus na/W > ^fn > W/a. This contradicts Eq.Q. □ 

Now assume that there is an e-error quantum distributed algorithm A that finds an ^-approximate 
MST in T4 time. We use A to construct an (0,e)-error algorithm that solves (/3r)-Ham(iV) in 
T4 + 0{D) time as follows. Let M be the input subnetwork. First we check if all nodes have degree 
exactly two in M. If not then M is not a Hamiltonian cycle and we are done. If it is then M consist 
of one cycle or more. It is left to check whether M is connected or not. To do this, we assign weight 
1 to all edges in H and weight W to the rest edges. We use A to compute an ^-approximate MST 
T. Then we compute the weight of T in O(D) = O(logn) rounds. If T has weight at most a(n — 1) 
then we say that H is connected; otherwise we say that it is (/3r)-far from being connected. 

To show that this algorithm is (0, e)-error, observe that, for any i, if H is i-far from being 
connected then the MST has weight at least (n — 1 — i) + iW since the MST will contain at least i 
edges of weight W . If H is connected then the MST has weight exactly n — 1 which means that T 
will have weight at most a(n — 1) with probability at least 1 — e, and we will say that H is connected 
with probability at least 1 — e. Otherwise, if H is (/3r)-far from connected then T always have 
weight at least 

(n-l-/3T) + (3TW > (3TW > (3(^B lognmax(^, y/n))W > fi^B logn^W > an > a(n - 1) 

for large enough n (note that (3 is a constant), and we will always say that H is (/3r)-far from being 
connected. Thus algorithm is (0, e)-error as claimed. □ 
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ii 



Formal Definitions and Further Technical Details 



12 Detailed Definitions 

12.1 Quantum Distributed Network Models 
Informal descriptions 

We first describe a general model which will later make it easier to define some specific models 
we are considering. We assume some familiarity with quantum computation (see, e.g., JSTJ [6T] for 
excellent resources). A general distributed network N is modeled by a set of n processors, denoted 
by i^i, ... , u ni and a set of bandwidth parameters between each pair of processors, denoted by B UiUj 
for any i ^ j, which is used to bound the size of messages sent from u\ to uj. Note that B UiUj could 
be zero or infinity. To simplify our formal definition, we let B UiUi — oc for all i. 

In the beginning of the computation, each processor U{ receives an input string xi, each of size 
b. The processors want to cooperatively compute a global function f(x\, . . . , x n ). They can do 
this by communicating in rounds. In each rounds, processor U{ can send a message of B UiUj bits 
or qubits to processor uj. (Note that u\ can send different messages to uj and Uk for any j ^ k.) 
We assume that each processor has unbounded computational power. Thus, between each round of 
communication, processors can perform any computation (even solving an NP-complete problem!). 
The time complexity is the minimum number of rounds needed to compute the function /. We 
can categorize this model further based on the type of communication (classical or quantum) and 
computation (deterministic or randomized). 

In this paper, we are interested in quantum communication when errors are allowed and nodes 
share entangled qubits. In particular, for any e > and function /, we say that a quantum 
distributed algorithm A is e-error if for any input (xi, . . . , x n ), after A is executed on this input any 
node U{ knows the value of f(x\, . . . , x n ) correctly with probability at least 1 — e. We let Qp N (N) 
denote the time complexity (number of rounds) of computing function / on network N with e-error. 

In the special case where / is a boolean function, for any eo, e\ > we say that A computes / 
with (eo, ei) -error if, after A is executed on any input (xi, . . . , x n ), any node U{ knows the value of 
/(#!, . . . , x n ) correctly with probability at least 1 — eo if . . . , x n ) = and with probability at 
least 1 — ei otherwise. We let Qto N a (N) denote the time complexity of computing boolean function 
/ on network N with (eo, ei)-error. 

Two main models of interest are the the £>-model (also known as CO HQ EST '(B)) and a new 
model we introduce in this paper called the server model. The £>-model is modeled by an undirected 
n-node graph, where vertices model the processors and edges model the links between the processors. 
For any nodes (processors) U{ and Uj, B UiUj = B UjUi = B if there is an edge uiUj in the graph and 
B UiUj = B UjUi = otherwise. 

In the server model, there are three processors, denoted by Carol, David and the server. In each 
round, Carol and David can send one bit to each other and to the server while receiving an arbitrarily 

large message from the Server, i.e. B C arol,David = B David ^ C arol = B C arol,Server = B David ^erver = 1 

and B g erver (j aro i B^ erver ]j av i d oc. 

We will also discuss the two-party communication complexity model which is simply the network 
of two processors called Alice and Bob with bandwidth parameters BAu C e,Bob — B Bob, Alice — 1- 
(Note that, this model is sometimes defined in such a way that only one of the processors can send 
a message in each round. The communication complexity in this setting might be different from 
ours, but only by a factor of two.) 

When N is the server or two-party communication complexity model, we use Q* ,server (f) and 
QV cc (f) instead of Qp N (f)- 
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Formal definitions 



Network States The pure state of a quantum network of n nodes with parameters {B UiUj }i<ij< n 
is represented as a vector in a Hilbert space 

H Ui uj — H UlUl ® H UlU2 ® • • • ® H UlUn ® H U2Ul ® • • • ® H U2Un ® . . . ® H UnUn 

l<i,j<n 

where ® is the tensor product. Here, H UiUi1 for any i, is a Hilbert space of arbitrary finite dimen- 
sion representing the "workspace" of processor U{. In particular, we let K be an arbitrarily large 
number (thus the complexity of the problem cannot depend on K) and H UiUi be a 2^-dimensional 
Hilbert space. Additionally, H UiUj , for any i ^ j, is a Hilbert space representing the B UiUj -qubit 

B TC 

communication channel from u\ to 'Uj. Its dimension is 2 if B UiUj is finite and 2 if B UiUj = oc. 
The mixed state of a quantum network N is a probabilistic distribution over its pure states 

{(pu K))} with pi > and^^ = 1 . 

i 

We note that it is sometimes convenient to represent a mixed state by a density matrix p = 

Initial state In the model without prior entanglement, the initial (pure) state of a quantum 
protocol on input (xi, . . . , x n ) is the vector 

!<,...,*„> = ® !<,...,*„ (i,3)) = K,...^(l,l))K,...,, n (l, 2))... K,...^ (n,n)> 

l<i,j<n 

where IV^,...,^^ j)) for an Y 1 < ^, j < is a vector in such that |^Si,...,x n = 

for any z and I^Jj! ... Xn (hj)) ~ |0) f° r anv i J (here, |0) represents an arbitrary unit vector 
independent of the input). Informally, this corresponds to the case where each processor u\ receives 
an input x\ and workspaces and communication channel are initially "clear" . 
With prior entanglement, the initial (pure) state is a unit vector of the form 

K,...,* B > = E ® i<*i,...,*„(u)>) (7) 

w y l<i,j<n J 

where \ipw,x u ...,x n (hj)) for an Y 1 < h 3 < n is a vector in such that ,x lv ..,z n (M)) = \xuw) 

for any i and = |0) f° r an y ^ 7^ J- Here, the coefficients ct^ are arbitrary real 

numbers satisfying J2 w a w = 1 that is independent of the input (x\, . . . , x n ). Informally, this 
corresponds to the case where processors share entangled qubits in their workspaces. 

Note that we can assume the global state of the network to be always a pure state, since any 
mixed state can be purified by adding qubits to the processor's workspaces, and ignoring these in 
later computations. 

Communication Protocol The communication protocol consists of rounds of internal compu- 
tation and communication. In each internal computation of the t th round, each processor ui applies 
a unitary transformation to its incoming communication channels and its own memory, i.e. H UjUi 
for all j. That is, it applies a unitary transformation of the form 

Ct, Ui ® ( (g) Iu 3 u k (8) 



23 



4>o("i"i) = \x ± 0) 



B\u^i) Bju^) B^u^) 



B(u 3Ul ) 



O (u 2 u 2 ) = \x 2 0) 
u 2 . o (u lW2 ) = |0) 
O (^ 2 ) = |0> 

o (u 3 u 3 ) = |* 3 0) 
"3- c&od^us) = |0> 

B(u 3 u 3 ) 

® (u 2 u 3 ) = |0> 

i 



. . . ._, B(u 2 u 1 ) B(u 1 u 2 ) 5(u 2 Wi) 

ui -4 ^ Q (u 2Ul ) = |0> 1J c lMl | ^"\ 2 ^ ; 

o ("3"i) = |0) 




B(u lUl ) 



B(u 2 u 2 ) 



B{u 2 u 3 ) 



Biu^) 



B(u 3 u 2 ) 



B(u 3 u 3 ) 



B^u^ output of Wl 

B(u 2Wl ) 

5(^3^) 



B(u ± u 2 ) 
B(u 2 u 2 ) 



^^A^"" Output of u 2 



B(u 3 u 2 ) 

B( Ul u 3 ) 
B{u 2 u 3 ) 



Output of i 



X 1 ,X 2l X 3 » 



Figure 11: A circuit corresponding to T rounds of communication on general distributed network having 3 
processors. The information flows from left to right and the line crossing each wire with a number B UiUj 
means that there are B u . u . qubits of information flowing through such wire. We note that the initial state 
in the picture is without entanglement. 



which acts as an identity on H u . Uk for all 1 < j < n and k ^ i. At the end of the internal 
computation, we require the communication channel to be clear, i.e. if we would measure any 
communication channel in the computational basis then we would get |0) with probability one. 
This can easily be achieved by swapping some fresh qubits from the private workspace into the 
communication channel. Note that the processors can apply the transformations corresponding to 
an internal computation simultaneously since they act on different parts of the network's state. 
To define communication, let us divide the workspace H UiUi of processor U{ further to 

H UiUi = H UiUu i ® H UiU%i2 ® . . . ® H UiUun 

where H UiUi j has the same dimension as H UiU .. The space H UiUi j can be thought of as a place 
where U{ prepares the messages it wants to send to uj in each round, while H UiUi ^ holds u^s 
remaining workspace. Now, for any j ^ z, u\ sends a message to uj simply by swapping the qubits 
in H UiUi j with those in H UiUj . Note that U{ does not receive any information in this process since 
the communication channel H UiU . is clear after the internal computation. Also note that we can 
perform the swapping operations between any pair i ^ j simultaneously since they act on different 
part of the network state. This completes one round of communication. We let 

K,...,* n > (9) 

denote the network state after t rounds of communication. 

At the end of a T-round protocol, we compute the output of processor U{ as follows. We view 
part of H UiUi as an output space of u\, i.e. H UiUi = Ho i ® for some Ho i and Hw { - We compute 
the output of Ui by measuring Ho i in the computational basis. That is, if we let K' be the number of 
qubits in Ho i and the network state after a T-round protocol be i/j Xi Xn then, for any w E {0, 1} K , 

Pr[Processor u\ outputs w] = | (^J Xn \ w ) 
Fig. [TT] depicts a quantum circuit corresponding to a communication protocol on three processors. 
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Error and Time Complexity For any < e < 1, we say that a quantum protocol A on network 
N computes function / with e-error if for any input (xi, . . . , x n ) of / and any processor U{, U{ outputs 
f(xi, . . . ,x n ) with probability at least 1 — e after A is executed. The e-error time complexity of 
computing function / on network TV, denoted by Qp N '(/), is the minimum T such that there exists 
a T-round quantum protocol on network TV that computes function / with e-error. We note that 
we allow the protocol to start with an entangled state. The * in the notation follows the convention 
to contrast with the case that we do not allow prior entanglement (which is not considered in this 
paper). When TV is the server model and two-party communication complexity model mentioned 
earlier, we use Qp server (f) and QV° c (f) respectively to denote the e-error time complexity. 

If / is a boolean function, we will sometimes distinguish between the error of outputting and 
1. For any < eo, e\ < 1 we say that A computes / with (eo, ei) -error if for any input (xi, . . . , x n ) 
of / and any processor U{, if f(xi, . . . , x n ) — then u\ outputs with probability at least 1 — eo and 
otherwise U{ outputs 1 with probability at least 1 — e\. The time complexity, denoted by Qto^ 1 (f) 
is defined in the same way as before. We will also use Q*eo,e[ ver '(f) and Qto^ 1 (f)- 

12.2 Distributed Graph Verification Problems 

In the distributed network TV, we describe its subgraph M as an input as follows. Each node u\ in TV 
receives an n-bit binary string x Ui as an input. We let x UiiUl , . . . , x UuUn be the bits of x Ui . Each bit 
x UijUj indicates whether edge U{Vj participates in the subgraph M or not. The indicator variables 
must be consistent, i.e., for every edge U{Uj E E(N), x UuUj — x UjUi (this is easy to verify with a single 
round of communication) and if there is no edge between U{ and uj in TV then x UiiUj — x UjUi = 0. 

We define M x mmmjXun , or simply M, to be subgraph of TV having edges whose indicator variables 
are 1; that is, 

E(M) = {(u h Uj) EE | Vi ^ j, x UuU . = x UjUi = 1}. 

We list the following problems concerning the verification of properties of subnetwork M on 
distributed network N from pH] . 

• connected spanning subgraph verification: We want to verify whether M is connected 
and spans all nodes of TV, i.e., every node in N is incident to some edge in M. 

• cycle containment verification: We want to verify if M contains a cycle. 

• e-cycle containment verification: Given an edge e in M (known to vertices adjacent to 
it), we want to verify if M contains a cycle containing e. 

• bipartiteness verification: We want to verify whether M is bipartite. 

• s-t connectivity verification: In addition to N and M, we are given two vertices s and t 
(s and t are known by every vertex). We would like to verify whether s and t are in the same 
connected component of M . 

• connectivity verification: We want to verify whether M is connected. 

• cut verification: We want to verify whether M is a cut of TV, i.e., N is not connected when 
we remove edges in M. 

• edge on all paths verification: Given two nodes u, v and an edge e. We want to verify 
whether e lies on all paths between u and v in M. In other words, e is a u-v cut in M. 

• s-t cut verification: We want to verify whether M is an s-t cut, i.e., when we remove all 
edges E(M) of M from TV, we want to know whether s and t are in the same connected 
component or not. 
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• least-element list verification [13, 130] : The input of this problem is different from other 
problems and is as follows. Given a distinct rank (integer) r(v) to each node v in the weighted 
graph TV, for any nodes u and v, we say that v is the least element of u if v has the lowest 
rank among vertices of distance at most d(u, v) from u. Here, d(u, v) denotes the weighted 
distance between u and v. The Least- Element List (LE-list) of a node u is the set {(u, d{u, v)) \ 
v is the least element of u}. 

In the least-element list verification problem, each vertex knows its rank as an input, and some 
vertex u is given a set S — {(^1, d(u, vi)), (v2,d(u,V2)}, • • .} as an input. We want to verify 
whether S is the least-element list of u. 

• Hamiltonian cycle verification: We would like to verify whether M is a Hamiltonian cycle 
of N, i.e., M is a simple cycle of length n. 

• spanning tree verification: We would like to verify whether M is a tree spanning N . 

• simple path verification: We would like to verify that M is a simple path, i.e., all nodes 
have degree either zero or two in M except two nodes that have degree one and there is no 
cycle in M. 

12.3 Distributed Graph Optimization Problems 

In the graph optimization problems V on distributed networks, such as finding MST, we are given 
a positive weight u(e) on each edge e of the network (each node knows the weights of all edges 
incident to it). Each pair of network and weight function (N,ou) comes with a nonempty set of 
feasible solution for problem V\ e.g., for the case of finding MST, all spanning trees of N are feasible 
solutions. The goal of V is to find a feasible solution that minimizes or maximize the total weight. 
We call such solution an optimal solution. For example, the spanning tree of minimum weight is the 
optimal solution for the MST problem. We let W = max^^^y) ^(e)/ mm eeE ^ ou(e). 

For any a > 1, an a- approximate solution of V on weighted network (N,u) is a feasible solution 
whose weight is not more than a (respectively, 1/a) times of the weight of the optimal solution of 
V if V is a minimization (respectively, maximization) problem. We say that an algorithm A is an 
^-approximation algorithm for problem V if it outputs an ^-approximate solution for any weighted 
network (iV, uo). In case we allow errors, we say that an ^-approximation T-time algorithm is e-error 
if it outputs an answer that is not ^-approximate with probability at most e and always finishes in 
time T, regardless of the input. 

Note the following optimization problems on distributed network N from |14j . 

• In the minimum spanning tree problem (22J, [55], we want to compute the weight of the 
minimum spanning tree (i.e., the spanning tree of minimum weight). In the end of the process 
all nodes should know this weight. 

• Consider a network with two cost functions associated to edges, weight and length, and a root 
node r. For any spanning tree T, the radius of T is the maximum length (defined by the length 
function) between r and any leaf node of T. Given a root node r and the desired radius a 
shallow-light tree [54J is the spanning tree whose radius is at most £ and the total weight is 
minimized (among trees of the desired radius). 

• Given a node 5, the s-source distance problem [21] is to find the distance from s to every 
node. In the end of the process, every node knows its distance from s. 
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• In the shortest path tree problem [22J, we want to find the shortest path spanning tree 
rooted at some input node s, i.e., the shortest path from s to any node t must have the same 
weight as the unique path from s to t in the solution tree. In the end of the process, each 
node should know which edges incident to it are in the shortest path tree. 

• The minimum routing cost spanning tree problem [68J is defined as follows. We think 
of the weight of an edge as the cost of routing messages through this edge. The routing cost 
between any node u and v in a given spanning tree T, denoted by ct(u,v), is the distance 
between them in T. The routing cost of the tree T itself is the sum over all pairs of vertices of 
the routing cost for the pair in the tree, i.e., J2 U veV(N) c t( u , v )- Our goal is to find a spanning 
tree with minimum routing cost. 

• A set of edges E' is a cut of N if N is not connected when we delete E' . The minimum cut 
problem [20J is to find a cut of minimum weight. A set of edges E' is an s-t cut if there is no 
path between s and t when we delete E' from N . The minimum s-t cut problem is to find 
an s-t cut of minimum weight. 

• Given two nodes s and t, the shortest s-t path problem is to find the length of the shortest 
path between s and t. 

• The generalized Steiner forest problem [30] is defined as follows. We are given k disjoint 
subsets of vertices Vi,...,T4 (each node knows which subset it is in). The goal is to find a 
minimum weight subgraph in which each pair of vertices belonging to the same subsets is 
connected. In the end of the process, each node knows which edges incident to it are in the 
solution. 

13 Detailed Proofs of Section g 
13.1 Two-player XOR Games 

We give a brief description of XOR games. AND game can be described similarly (their formal 
description is not needed in this paper). For a more detailed description as well as the more general 
case of nonlocal games see, e.g., (121 [6] and references therein. An XOR game is played by three 
parties, Alice, Bob and a referee. The game is defined by X and y which is the set of input to Alice 
and Bob, respectively, 7r, a joint probability distribution n : X x 3^ —± [0, 1], and a boolean function 
/:.V\J^{(). 1), 

At the start of the game, the referee picks a pair (x,y) <E X x y according to the probability 
distribution tt and sends x to Alice and y to Bob. Alice and Bob then answer the referee with 
one-bit message a and b. The players win the game if the value a © b is equal to f(x,y). In other 
words, Alice and Bob want the XOR of their answers to agree with /, explaining the name "XOR 
game." 

The goal of the players is to maximize the bias of the game, denoted by Bias 7r (/) 3 which is the 
probability that Alice and Bob win minus the probability that they lose. In the classical setting, 
this is 

Bias^(/) = max V (-l) f ^ y \(x,y)(-l)< x \-l) h ^ 

a\X— >{ — 1,1}, f — ' 

b:y^{-i,i} {x,y)£Xxy 
= max E {x ^[(-l)^\-l) b (y\-iy^} . 

a€{— 1,1}' 1 j 

be{-i,iy\y\ 

In the quantum setting, Alice and Bob are allowed to play an entangled strategy where they may 
make use of an entangled state they share prior to receiving the input. That is, Alice and Bob start 
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with some shared pure quantum state which is independent of the input and after they receive input 
(x, y) they make some projective measurements depending on (x, y) and return the result of their 
measurements to the referee. Formally, an XOR entangled strategy is described by a shared (pure) 
quantum state E C dxd for some d > 1 and a choice of projective measurements {A^, Aj,} and 
{By, By} for all x G X and y E y. When receiving input x and y, the probability that Alice and 
Bob output (a, b) E {0, l} 2 is A% ® B b y Thus, the maximum correlation can be shown to be 
(see [6 for details) 

Bias n (f) = maxE (a , tfW [M {A\ - A° x ) (B l y - B° y ) \^) (-!)/( 



x,y) 



where the maximization is over pure states and projective measurements {A®, A\} and {By, By} 
for all x E X and y E y. In the rest of this paper, Bias 7r (/) always denotes the maximum correlation 
in the quantum setting. We let 

Q*> XOR (f) = mmBias^f) . 

7T 

We note that while the players could start the game with a mixed state, it can be shown that pure 
entangled states suffice in order to maximize the winning probability (see, e.g., [6]). 

13.2 Prom Nonlocal Games to Server-Model Lower Bounds 



Lemma 13.1 (Lemma |8.2| restated). For any boolean function f and eo,ei > ; there is an XOR- 
game strategy A 1 and AND-game strategy A" such that, for any input (x,y), 



ris~}* , server / n\ 

with probability 4 ^ e o> e i A and A are able to simulate a protocol in the server model 

and hence output f(x,y) with probability at least 1 — Cf( x ,y)> 

otherwise A! outputs and 1 with probability 1/2 each, and A! f outputs with probability 1. 



Proof. We have sketched the proof in Section [871] We now provide more detail. 

Let c = Qto,el ver '(/)? i- e - Carol and David communicate with the server for c rounds where 
each of them sends one qubit to the server per round while the server sends them messages of 
arbitrary size. While Alice and Bob cannot run a protocol A in the server model since they cannot 
communicate to each other, we show that they can obtain the output of A with probability 
To be precise, for any input (x, y) let Px,y ctnxi Qx,y be the probability that A{x, y) is zero and one 
respectively. We will show that 



Alice and Bob can obtain the final state of A with probability 4 _2c and in that case 
output the correct answer with high probability. If they do not obtain that state one 
of them will output a random bit for XOR games and one of them will output for 
AND games. 



(10) 



2c 



Hence the XOR game will accept with probability |(1 — 4 _2c ) + 4~ 2c q x ,y = \ + (Qx,y ~\)^ 
and thus have a bias of at least 4 _2c • min{l/2 — eo, 1/2 — ei}. 

The AND game will accept 1-inputs with probability at least q' x y > Furthermore if A never 
accepts a 0-input, then neither will the AND game. 



Let us first prove Statement (10) with an additional assumption that there is a "fake" server 
that Alice and Bob can receive a message from but cannot talk to (we will eliminate this fake server 
later). We will call this a fake server to distinguish it from the "real" server in the server model. 

First let us note the Carol and David need not talk to each other, but can send their messages 
to the server who can pass them to the other player. Since the server can also set up entanglement 
between the three parties without cost, Carol, David and the server can use teleportation (see [51] 
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for details) and we can assume that in protocol A Carol and David send 2 classical bits per round 
to the server instead of one qubit. These two bits are also uniformly distributed, regardless of the 
state of the qubit. 

Thus, for any input (x,y), the messages sent by Carol and David in protocol A will be a, b E 
{0, l} 2c with some probability, say p x ,y,a,b- For simplicity, let us assume that each communication 
sequence (a, b) leads to a unique output of A on input (x, y) (e.g., by requiring Carol and David to 
send their result to the server in the last round). Let A(x, y, a, b) be the output of the protocol A 
on input (x, y) with communication sequence (a, b). Then the probability that A outputs zero and 
one is, respectively, 

Px,y — ^ ^ Px,y,a,b an d Q x ,y — ^ ^ Px,y,a,b • 

(a,b): A(x,y,a,b)=0 (a,b): A(x,y,a,b)=l 

The strategy of Alice and Bob who play the XOR and AND games is trying to "guess" this sequence. 

In particular, Alice, Bob and the fake server will pretend to be Carol, David and the real server as 
follows. Before receiving the input, Alice, Bob and the fake server use their shared entanglement to 
create two shared random strings of length 2c, denoted by a 1 and and start their initial entangled 
states with the same states of Carol, David and the server. In each round t of A, Alice, Bob and 
the fake server will simulate Carol, David and the real server, respectively, as follows. Let c^i and 
C£,2 be two bits sent by Carol to the real server at round t. Alice will check whether the guessed 
communication sequence a' is correct by checking if c^i and c^i are the same as a 2t _i and a 2t which 
are the (2t — l) th and {2t) th bits of a! . If they are not the same then she will 'abort' which means 
that 

• Alice will output and 1 uniformly random if she is playing an XOR game, and 

• Alice will output if she is playing an AND game. 

Similarly, Bob will check whether the guessed communication sequence b r is correct by checking 
b' 2t _ x and b 2t with two classical bits sent by David to the server. Moreover, the fake server will 
pretend that it receives a f 2t _i, o! 2v b 2t _ 1 and b 2t to execute A and send huge quantum messages to 
Alice and Bob. Alice and Bob then execute A using these messages. After 2c rounds (if no player 
aborts), the players output the following. 

• In XOR games, Alice will send Carol's output to the referee, and Bob will send to the referee. 

• In AND games, Alice will send Carol's output to the referee, and Bob will send 1 to the referee. 

Thus, if one or both players aborts then the output of an XOR game will be uniformly random 
in {0, 1}. For an AND game in case of a abort the players reject. Otherwise, the result of the XOR 
and AND games will be A(x, y, a, b). The probability that Alice and Bob do not abort, given that 
the communication sequence of A on input (x, y) is a and b is Pr[a' — a f\b' — b] — 

This almost proves Statement ( [To| ) (thus the lemma) except that there is a fake server sending 
information to Alice and Bob in the XOR and AND game strategy. To remove the fake server, 
observe that we do not need an input in order to generate the messages the fake server sent to Alice 
and Bob. Thus, we change the strategy to the following. As previously done, before Alice, Bob 
and the fake server receive an input they generate shared random strings (a', b r ) and start with the 
initial states of Carol, David and the real server. In addition to this, the fake server use the string 
a 1 and b r to generate the messages sent by the real server to Carol and David. It then sends this 
information to Alice and Bob. We now remove the fake server completely and mark this point as a 
starting point of the XOR and AND games. After Alice and Bob receive input (x, y), they simulate 
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protocol A as before. In each round, when they are supposed to receive messages from the fake 
server, they read messages that the fake server sent before the game starts. Since the fake server 
sends the same messages, regardless of when it sends, the result is the same as before. Thus, we 



achieve Statement (10) even when there is no fake server. This completes the proof of Lemma 



13.1 



□ 

13.3 Lower Bound of IPmod3 n 

Using the above lemma, we prove the following lemma which extends the theorem of Linial and 
Shraibman [36] from the two-party model to the server model. Our proof makes use of XOR games 
as in [42J (attributed to Buhrman). For any boolean function / : X x 3^ —> {0, 1}, let Af be a 
|Af|-by-|y| matrix such that Af[x,y] = (— iy( x ^\ Recall that for any matrix A, ||A||i = Ylij 

Lemma 13.2. For boolean function f and < e < 1/4 

42Q:—C/) > max <^/,Af> -2 C ||Af|| 1 = 2 
- m 72 (AO 

Proof. We first prove the following claim. 

Claim 13.3. For any boolean functions /, g on the same domain, probability distribution tt and 
< e < 1, 

(Af,A g ott) - 2e 
Bias 7r (^ , J > ^2Q* ,server (/) ' 

Proof. First, suppose that when receive input Alice and Bob can somehow compute f(x,y) 

and use this as an answer to the XOR game (e.g., Alice and Bob returns f(x,y) and 1 to the 
referee respectively). What is the bias this strategy can achieve? Since the probability of winning 
is E^/M^M^t 1 ^)' the bias is straightforwardly 

^2 K(x,y)- ^2 nfav) = ^27r(x,y)Af[x,y]A g [x,y] = {A f ,A g ott) 

f( ( , (x,y) *,y 

f(x,y)=g(x,y) f(x,y)^g(x,y) 

Let A be an e-error protocol for computing / in the server model and A(x, y) be the output of 
A (which could be randomized) on input (x,y). Now suppose that Alice and Bob use A(x,y) to 
play the XOR game. Then the winning probability will decrease by at most e. Thus the bias is at 
least 

(A fl A g o7r)-2e. (11) 



Now suppose that Alice and Bob use protocol A! from Lemma 13.1 with eo = e\ — e to play the 



, server / r\ 

XOR game. With probability 1 — 4 ^ e v\ A will output randomly; this means that the bias 



is 0. Otherwise, A! will behave as an e-error algorithm. Thus, we conclude from Eq.(ll) that the 
bias is at least 

4 -2Q, W({A f ,AgO<ir) -2e) . 
This completes the claim. □ 
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Thus, for any tt 

~~ Bias^g) 

Note that Bias^g) = j$(A g o tt) [66] (also see [42, Theorem 5.2]). So, 

4 2Qp server (f) > ( A fi A 9 7r ) ~ 2e 

7*(^ott) 

Since this is true for any tt and g, 

4**™ (/) > m ax ( ^^°" ) - 26 = max ^^-^l 1 . 
^ 7|(^ott) m 7 *(M) 

This proves the first inequality in Lemma [13. 2| 

For the second inequality, we use Proposition 1 in [33] (proved in [^2] ) which states that for any 
norm $, matrix A and < a < 1, the ^-approximate norm is 

This means that 7^ (A/) = max^ 1(^/^)1 ^ll^lli ag c i a i me( j < □ 

For finite sets X,Y, and E, a function / : E n {0, 1}, and a function g : X x Y —> E, the 
block composition of / and g is the function / o g n : X n x Y n — >► {0, 1} defined by (/ o g n )(x, y) = 
f(g(x 1 1 y 1 ) 1 ... 1 g{x n 1 y n )) where (x\y l ) E X x Y for all z = l,...,n. For any boolean function 
/ : {0, l} n -> {0, 1}, let f be such that, for all x E {0, l} n , f(x) = -1 if f(x) = and f(x) = 1 
otherwise. The e- approximate degree of /, denoted by deg € (f) is the least degree of a real polynomial 
p such that \f'(x) — p(x)\ < e for all x E {0, l} n . We say that g is strongly balanced if all rows and 
columns in the matrix A g sum to zero. For any m-by-n matrix A, let size(A) — m x n. We now 
prove a "server-model version" of Lee and Zhang's theorem [43, Theorem 8]. Our proof is essentially 
the same as their proof (also see [321 Theorem 7.6]). 

Lemma 13.4. For any finite sets X,Y, let g : X x Y — » {0, 1} be any strongly balanced function. 
Let f : {0, l} n —> {0, 1} be an arbitrary function. Then 

Q *,server {f Q gn) > d ^ {f) ^ ^J^j^ _ (1) 

/or am/ < e < 1/4. 

Proof. We simply follow the proof of Lee and Zhang [43J and use Lemma 13.2 instead of Linial- 
Shraibman's theorem. First, we note the following inequality which follows from the definition of 
72: For any 8 > and m-by-n matrix A, 

4{A)= min 72(5) > min ^ tr - " A "* r 



B-.WB-AW^KS BiWB-AWooKS ^size(B) ^/size(A) 

where the first and last equalities are by definition of the approximate norm (see, e.g., [13} Definition 
4]) and the inequality is by the definition of 72 norm (see, e.g., [33 Definition 1]). Using A — Af og 
which is an |X|-by-|Y| matrix, we have 

ii(A fog) > P/o ;f . (12) 

^size{A fog ) 

The following claim is shown in the proof of Theorem 8 in 



31 



Claim 13.5 (US]) 



\ A fo. 



^size{Af 



5 

■gwtr > s 



deg 2 i(/) 



\A n 



(13) 



Proof. We note the following lemma (noted as Lemma 1 in |13]) which shows that there exists a dual 
polynomial of f which is a polynomial v which certifies that the approximate polynomial degree of 
/ is at least a certain value. 

Lemma 13.6 (1513 ED). For any f : {0, l} n -> {0,1}, let f be such that f(z) = (-l) /(z) and 
d = deg$(f). Then, there exists a function v : {0, l} n — > R swc/i t/iat 

1- (^j Xt) — /or every character xt with \T\ < d. 

2. \\v\\i = 1. 

5. <«,/')> & 



Let v be a dual polynomial of / as in the above lemma. We will use B — ( 
"witness matrix", i.e., 



B[x,y] 



2 n 



size(A g 



; v(g(x uyi ),...,g(x n ,y n )). 



It follows that 



size(A g ))Avog &S a 

(14) 



z 

{A fog ,B) = size ( Ag ^n( M f°9> A v°9) 



size(A 6 



f(g(x\ y 1 ),..., g(x n , y n ))v{g{x\ y l ), . . . , g(x n , y n )) 



size(A c 



size(A 



)n ^2 

ze{o,i} r 



size(Ac 



9) ze{o,iy 



)n 5-/ 



= /(*M*) 

= </,«> 

> <5 



E 1 

x,y: 
g(x\y t )=z i 
VKi<n 



J 



\ 



mv(z)H 

i=i 

( t 

f(z)v(z 



( \\ 
E i 



Xgix^y^Zi ) 



\ 



\ 



E i 



(15) 
(16) 

(17) 



(18) 



(19) 

(20) 

(21) 
(22) 
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where Eq.(20) is because g is strongly balanced which implies that g is balanced, i.e. g{x l 1 y l ) is 
(and 1) for half of its possible inputs (i.e. size(A g )/2 entries of A g are 1 (and —1)); thus, 

1 = size(A g )/2. 

x',y': 

g(x',y')=Zi 

A similar argument and the fact that \\v\\i = 1 can be used to show that 



\B\ 



(23) 



Now we turn to evaluate the spectral norm ||£>||. As shown in [43J, the strongly balanced property 
of g implies that the matrices \T ° g n and xs ° 9 n are orthogonal for distinct sets S,TC {0, l} n . 
Note the following fact (Fact 1 in [43J): For any matrices A' and B' of the same dimension, if 
A'(B')t = (A'^B' = then \\A + B\\ = max{||A||, \\B\\}. Using this fact, we have 



1511 = 



2 n 



size(Ai 



— 1| v T A XTO gn\ 



size(A c 



TC[n] 



-max\v T \\\v T A XTOg n 



(by the fact above) 



max2 n |£ T | Y\ 



\A 



G 



size(A g 



< max I T — 

\A 



A 



G I 



Tr^/o 11 size(A g 

\ d 
g\\ \ 



y/size(A g ) I \size(A g 



n/2 



(24) 
(25) 
(26) 

(27) 
(28) 



where Eq.(27) is because \vt\ < l/2 n as \\v\\\ — 1 and Eq.(28) is because || J\\ — y/size(A g ). 

We note that for any < e < 1, norm $ : W 1 — > K and vector v G M n , the approximate norm 
is & € (v) = max u ^ijfc^j-^ (see, e.g., (12] and (121 Proposition 1]). Note also that if $ is the trace 
norm then its dual $* is the spectral norm (this is noted in [131 )• Thus, 



\A 



,,5/2 



(5/2)11^1 



> 



> 



\\B'\ 

\{A fog u,B)\-5/2 



\B\ 



8-8/2 



\B\\ 

> W) 

> W) 



^/ size(A g 
\\AjT 



size(Af og 



(byEq.(23)) 



(byEq.(22)) 



(byEq.(28» 



(29) 
(30) 
(31) 

(32) 
(33) 



where the last inequality is because size(Af og ) = size(A g ) n . This completes the proof of the 
claim. □ 
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The lemma follows immediately from Eq.(12) and Eq.(13) by plugging in Lemma 



13.2 



4 2Q e *' 



* , server 



(f°g n ) 



>7 2 2£ (^/o 5 «) > 



\\A t \\ 2e 
^/size(Af og 



>(2e) 



deg 4e (/) 



\A„ 



Lemma 13.4 follows (the term 2e will contribute to the term "— O(l)"). 



□ 



Now, we prove the lower bound of IPmod3 n . Our proof essentially follows Sherstov's proof [60J 
(also see [42, Section 7.2.3]). We can assume w.l.o.g. that n is divisible by 4. Consider the promise 
version of IPmod3 n where any n-bit string input x E X and y E y has the property that for any 

< i < (n/4) - 1, 

^4i+i^4i+2^4i+3^4i+4 £ {0011, 0101, 1100, 1010} and 
2/4<+iy4i+22/4*+32/4i+4 G {0001, 0010, 1000, 0100} . 

Now we show that the claimed lower bound holds even in this case. This lower bound clearly implies 
the lower bound of the more general case of IPmod3 n where no restriction is put on the input. 
Observe that, for any (x, y) E X x y, the function IPmod3 can be written as 

/ og n / A {x,y) = f{g{xi ...x^yi- . .?/4), #(^5 • • .^8,2/5 • - - 2/s) 5 • • • 5 ff(^n-3 • ..x n ,y n - 3 . . .y n )) 
where 

#(^4i+l • • • ^4z+4, 2/4z+l • • • 2/4i+4) = (^42+1 A J/4i+l) V (x 4i+ 2 A J/4i+2) V (x 4i+3 A i/4z+3) V (x 4i+4 A ^+4) 

for all < i < (n/4) — 1, and f(zi, . . . , z n /±) = 1 if z\ + . . . + £ n / 4 can be divided by 3 and otherwise. 
Note that IPmod3(x, y) — fog n / A (x, y) since the promise implies that g(xu+i . . . x 4 ^ +4 , yu+i • • • VAi+a) 

1 if and only if x±i+iy±i+i + • • • + ^4i+42/4i+4 = 1- The matrix A g is 





0001 


0010 


1000 


0100 


0011 


f -1 


-1 


1 


1 \ 


0101 


-1 


1 


1 


-1 


1100 


1 


1 


-1 


-1 


1010 


I 1 


-1 


-1 


1 / 



which is clearly strongly balanced. It can be checked that this matrix has spectral norm \\A g \\ = 2^/2 
(see, e.g., [121 Section 7.2.3]). Moreover, by Paturi [53J (see also [16] and [601 Theorem 2.6]), 
deg 1 / 3 (/) = O(n). Thus, Lemma 13.4 implies that 



Ql 



"(/°^)>deg 1/3 (/)log 2 



V4 



0(1) 



= deg 1/3 (/)log 2 v / 2-0(l) 
= O(n) . 



We note that the same technique can be used to prove many bounds in the server model similar 
to bounds in [551 EB S3] • 
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Vo - - Vn 



mod 3 = 



^ Xj • y t mod 3 = 1 



Vq V 



I 



x t • y t mod 3 = 2 



Figure 12: The resulted graph G in three situations depending on the value of ^i<i< n x i ' Vi m °d 3. Dashed 
lines (in red) represent paths connecting Uq, . . . , Vq and i^, . . . , v\. Thick lines (in gray) show the fact that we 
identify nodes on two sides, i.e. v J = v J n for all < j < 2. Our main observation is that G is a Hamiltonian 
cycle if and only if Xa<i< n x * ' Vi m °d 3^0 (cf. Lemma 14.3). 



14 Detail of Section [9] 

First, let us recall that Alice and Bob construct a gadget Gi using X{ and yi as shown in Fig. [4| 
Fig. [5] shows how G{ looks like for each possible value of X{ and yi. It follows immediately that G{ 
always consist of three paths which connect v\_ Y to y^ x ' y ^ mod 3 5 as in the following observation. 

Observation 14.1 (Observation |9.2| restated) . For any value of (xi^yi), Gi consists of three paths 
where v\_ x is connected by a path to v ^ Xt ' y ^ mod 3 ; for any < j < 2. Moreover, Alice's (respec- 
tively Bob's) edges, i.e. thin (red) lines (respectively thick (blue) lines) in Fig. Q form a matching 
that covers all nodes except vj (respectively v\_ x ) for all < j < 2. 

Finally, we connect gadgets G{ and Gi+i together by identifying rightmost nodes of G{ with 
leftmost nodes of G^+i, as shown in Fig. [6] (gray lines represent the fact that we identify rightmost 
nodes of G n to leftmost nodes of G\). 



Lemma 14.2 (Lemma 9.3 restated). G consists of three paths P°, P 1 and P 2 where for any 



< j < 2, Pi has vl as one end vertex and v^ 



(j'+Ek 



, Xi-yi) mod 3 



as the other. 



Proof. We will show that for any 2 < k < n and < j < 2, P J has Vq as one end vertex and 

U+t2i<i<k x i-yi) mod 3 



k = 2 by Observation 



as the other. We prove this by induction on k. Our claim clearly holds for 
1, Now assume that this claim is true for any 2 < k < n — 1, i .e., v J Q 
is connected by a path to v J k where f = (j + Xa<z<fc x i ' Vi) m °d 3 - By Observation 
connected by a path to v J " where j" = (f + x k+1 • y k+1 ) mod 3 = ( j + Ei<;</c+i x i ' Vi 



14.1 



v k is 



claimed. 



mod 3 as 

□ 



Lemma 14.3. Each player's edges form a perfect matching in G. Moreover, G is a Hamiltonian 
cycle if and only if Y,i<i< n x i ' Vi mod 3 ^ °- 

Proof. We consider three different values of z = J2i<i< n x i ' Vi m °d 3 as shown in Fig. 12 If z = 
then Lemma 14.2 implies that v J will be connected to v 3 n by a path, for all j. After we identify 
.1 have three distinct cycles, each containing a distinct v J q — v 3 n . If z = 1 then 



v J with v n we wi 



Lemma 



14.2 



implies that v J q will be connected to Vn ° by a path. After we identify v J q with 
Vn we will ha ve one cycle that connects Vq 



Lemma 



14.2 



v® to vl = Vq then to v^ — Vq. Similarly, if z = 1 then 



implies that v J will be connected to Vn 



(j+2) mod 3 



by a path. After we identify v J with 
v n we will have one cycle that connects Vq = v n to v\ — Vq then to v n = Vq. □ 
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Figure 13: (Fig. 10 reproduced) The network iV which consists of network N' and some "highways" which are 
paths with nodes h l - (i.e., nodes in blue). Bold edges show an example of subnetwork M when the input per- 
fect matchings are E c = {(ui, u 2 ), (u 3 , u 4 ), . . . , (ur+fc-i, ur+k} and = {(u 2 , u 3 ), (u 4 , u 5 ), . . . , (^r+fc, ^i)}- 
Pale edges are those in N but not in M. 



15 Full proof of Theorem 10.1 

Theorem 15.1 (Theorem 10. 1| restated). For any B , L, Y > logL, f3 > and eo,ei > ; there 
exists a B-model quantum network N of diameter O(logL) and @(TL) nodes such that 



L 



tfar^fW) < 2 " 2 then ^*o™( p r) = 0((B]ogL)Q^ ei (P(N))) 
where P can be replaced by Ham and (/3r)-Conn. 
15.1 Description of the network TV 



In this section we describe the network N as shown in Fig. [13j We assume that L = 2 l + 1 for 
some i. This can be assumed without changing the theorem statement by simply increasing L to 
the nearest number of this form. 

The two basic units in the construction are paths and highways. There are T paths, denoted by 
P 1 , P 2 , . . . , P r , each having L nodes, i.e., for j = 1, 2, . . . T, 



We construct k 
and edges. 



V(P l ) = {v{, . . . ,4} and E{P i ) = {{v),v) +1 ) | 1 < j < L - 1} . 

log 2 (L — 1) highways, denoted by H 1 , . . . , H k where H l has the following nodes 



V(IP 



{h\ +j2i \0<j<— } 



and 
L 



{(K +j2i , K +(j+1)2i ) | o < j < ——} . 



For any node hk we add an edge (h^v 1 -) for any j. Moreover for any node h % - we add an edge 



{hi- 1 1 h l } ). Figure 13 depicts this network. We note the following simple observation. 



Observation 15.2. The number of nodes in N is n — ®{LT) and its diameter is O(logL). 
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15.2 Simulation 

For any < t < (L/2) — 2, we partition V(N) into three sets, denoted by Sq, Sjj and S s , as follows 
(also see Fig. [13]) . 

S t c = {v%h) | 1 < * < T, 1 < i < * + 1}, (34) 
= {v), h)\l<i<T, L-t<j<L}, (35) 
S t 3 = V(N)\(S t c US t D ). (36) 

Let A be any quantum distributed algorithm on network N for computing a problem P (which 
is either Ham or (f3T) — Conn). Let T4 be the worst case running time of algorithm A (over all 
inputs). We note that T4 < (L/2) — 2, as assumed in the theorem statement. We show that Carol, 
David and the server can solve problem P on (r + fc)-node input graph using small communication, 
essentially by "simulating" A on some input subnetwork M corresponding to G — ([/, Eq U Ed) 
in the following sense. When receiving Eq and Ed, the three parties will construct a subnetwork 
M of N (without communication) in such a way that M is a 1-input of problem P (e.g., M is a 
Hamiltonian cycle) if and only if G = (U, Eq U Ed) is. Next, they will simulate algorithm A in such 
a way that, at any time t and for each node v l - in iV, there will be exactly one party among Carol, 
David and the server that knows all information that v l - should know in order to run algorithm A, 
i.e., the (quantum) state of v % - as well as the messages (each consisting of B quantum bits) sent to 
Vj from its neighbors at time t. The party that knows this information will pretend to be v l - and 
apply algorithm A to get the state of v l - at time t + 1 as well as the messages that v l - will send to 
its neighbors at time t+1. We say that this party owns v % - at time t. Details are as follows. 

We will define a server-model protocol A! that guarantees that, at any time t, Carol, David and 
the server will own nodes in sets S l c , S f D and Sg, respectively, at time t. That is, Carol's workspace, 
denoted by Hc,c, contains all qubits in H vv t , for any v E S l c and v' E V(N), resulting from t rounds 
of an execution of A. Similarly, David's (respectively the server's) workspace, denoted by Hd,d 
(respectively H$,s), contains all qubits in H vv > for any v E S f D (respectively v E Sg) and v f E V(N) 
resulting from t rounds of A. In other words, if after t rounds of A network N has state 

Wm) = y, [ a ™ ® i<m(^')> 

w \ v,v'eV(N) 

then we will make sure that the server model has state 

w \ i,je{C,D,S} 

where |^ G (i,j)) = |0), for any i,j E {C, D, S} such that i ^ j, and for any i E {C, D, S} 



I^,gM>= ® I<m(^») • (37) 
vest,v'ev(N) 

Let r 7 = T + k. Fix any T^node input graph G = (J7, Eq U Ed) of problem P where Eq and 
Ed are edges given to Carol and David respectively. Let U = {u\, . . . ,u^}. For convenience, for 
any 1 < j < k, let v\ + ^ = h{ and = h? L We construct a subnetwork M of N as follows. For 
any i ^ j, we mark v\v{ as participating in M if and only if U{Uj E Eq- Note that this knowledge 
must be kept in qubits in H v ^ and H v j v ^ in network N as we require each node to know whether 
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edges incident to it are in M or not. This means that this knowledge must be stored in Hc,c since 
v\,v{ E Sq. This can be guaranteed without any communication since Carol knows Eq- Similarly, 
we mark v l L v J L as participating in M if and only if uiUj E Ed, and this information can be stored 
in Hd,d without communication. Finally, we let all edges in all paths and highways be in M. This 



information is stored in H$,s- An example of network M is shown in Fig. 13, To conclude, if the 
initial state of N with this subnetwork M is 

w \ v,v'eV(N) 

then the server model will start with state \^q) = J2 W ®ije{CDS} I^Ig(^'))) where 
|0), for any i, j E {C, D, S} such that i ^ j, and for any i E {C, D, S} 

K, g (m)>= (8) i<Af («',«)>• 



Thus Eq.(37) holds for t = 0. We note the following simple observation. 



Observation 15.3. G = (U,Ec U is a Hamiltonian cycle if and only if M is a Hamiltonian 
cycle. G is connected if and only if M is connected, and for any 8, G is 8 -far from being connected 
if and only if M is 8 -far from being connected. 

Thus, Carol, David and the server can check whether G is a Hamiltonian cycle if they can check 
whether M is a Hamiltonian cycle. Similarly, they can check if G is connected or (/3r)-far from 



being connected by checking M. So, if Eq.(37) can be maintained until A terminates then we are 
done since each server-model player can pretend to be one of the nodes they own and measure the 
workspace of such node to get the property of M. 

Now suppose that Carol, David and the server have maintained this guarantee until they have ex- 
ecuted A for t — 1 steps, i.e., player i owns the nodes in S^ _1 at time t— 1. They maintain the guaran- 
tee at step t as follows. First, each player simulate the internal computation of A on nodes they own. 
That is, for each node v E V(N) : the player i such that v E S^ 1 applies the transformation Ct jV (cf. 
Section 



12.1) on qubits in workspace (S) v 'eV(N) Hv'v which is maintained in H^i at time t — 1. This 
means that if after the internal computation N has state \v f M ) = J2 W ®v v'eV(N) \ v w m( v i ^0)) 
then the server model will have state |T^) = J2 W \ a ™ ®i je{C D S} I^L g(*> .?"))) wnere \^w(hj)) — 



|0), for any i ^ j, and |T^ G (i,i)) = ® veS j, v >eV(N) I^,mK^)) for an y L Note that the server 
model players can simulate the internal computation of A without any communication since a player 
that owns node v has all information needed to simulate an internal computation of v (i.e., the state 
of v as well as all messages v received at time t — 1). 

At this point, for any i E {C, D,S}, player z's space contains the current state and out-going 
messages of every node v E S^ _1 . They will need to receive some information in order to guarantee 
that they own nodes in Sj. First, consider Carol. Let S' c be the set of rightmost nodes in the set 
S^T 1 , i.e. S' c consists of and h l - for all i and j — argmaxj{/^- E S^ 1 }. 

Note that Carol already has the workspace and all incoming messages of nodes in S^T 1 \ S' c at 
time t. This is because for any v E S t c ~ 1 \S , Cl Carol already has qubits in H v / V for all v' E V(N). For 
each v E S' Cl Carol is missing the messages sent from v's right neighbor; i.e., Carol does not have 
qubits in ^u| +2 <u* +1 an d H h i fh i for all z, j — argmaxj{/^- E S^ 1 } and f — argminj/j/i*, ^ S^ 1 }. 

Since S' c C S^>, we need to make sure that Carol has all information of nodes in S' r at time t. 
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For a non- highway node for all i, this can be done by letting the server who owns v\+ 2 sen d 
to Carol a message sent from v\ +2 to v\ +1 at time £, i.e., qubits in H v % % . For highway node h l - for 

all i and j = argmaxj{/^- E S^ 1 }, its right neighbor h 1 -,^ where f = argminj/j/i*, ^ S^ 1 }? might 
be owned by David or the server. In any case, we let the owner of h 1 -, send to Carol the message 
sent from h 1 -, to h l - at time t, i.e., qubits in H h i /h i. The cost of doing this is zero if h 1 -, belongs to 

the server and at most B if h 1 -, belongs to David since the message size is at most B. In any case, 
the total cost will be at most Bk since there are k highways. We can thus make sure that Carol 
gets the information of nodes in S^T 1 at time t at the total cost of at most Bk. 

In addition to this, Carol needs to get information of nodes in S l c \ S 1 ^ 1 at time t. This means 
that, for any v E Sq \ S 1 ^ 1 she has to receive the qubits stored in H v t v for all v' E V(N). For 
any non- highway node v\+ 2 £ S l c \ S^T 1 , it can be checked from the definition that v\+ 2 an d all its 
neighbors are in S^T 1 U S^ 1 . So, we can make sure that Carol owns v\ +2 by letting the server send 
to Carol the workspace of v\ +2 and messages sent to v\ +2 by its neighbors in S^ -1 (i.e. qubits in 
H v , v i for all v' E S 1 ^ 1 ). This communication is again free. For a highway node h l - in S l c \ S^T 1 , it 



can be checked from the definition that h % - as well as all its non-highway neighbors are in S^T 1 US^ -1 
The only neighbor of h l - that might be in S^ 1 is its right neighbor, say h 1 -,^ in the highway. If h 1 -, is 
in S^ 1 then David has to send to Carol the message sent from h 1 -, to h 1 -. This has cost at most B. 
So, Carol can obtain the workspace of h l - as well as all messages sent to h l - at the cost of B. Since 
there are k highway nodes in S l c \ S^T 1 , the total cost for Carol to obtain information needed to 
maintain nodes in S f c \ S^T 1 is Bk. We conclude that Carol can obtain all information needed to 
own nodes in Sq at time t at the cost of 2Bk. 

We can do the same thing to guarantee that David owns all nodes in at time t at the cost 
of 2Bk. Now we make sure that the server own nodes in S f s . First, observe that the server already 
has the workspace of all nodes in since C S^ -1 . Moreover, the server already has all messages 
sent to all non-highway nodes in Sg (i.e. Vj for all t + 2 < j < L — t — 1 and 1 < i < T) since 
all of their neighbors are in S^ -1 . Additionally, each leftmost highway node h l - E Sg, for any i and 
j = argminj{/^- E Sg}, has at most one neighbor in S^T 1 (i.e., its right neighbor in the highway). 
Similarly, each rightmost highway node h % - E Sg, for any i and j' — argmaxj/{/i^, E Sg}, has at 
most one neighbor in S^ 1 (i.e., its right neighbor in the highway). Thus, the server needs to obtain 
from Carol and David at most 2B qubits to maintain h l - and h 1 -,. Since there are k highways, the 
server needs at most 2kB qubits total from Carol and David. We thus conclude that the players 
can maintain Eq.(37) at the cost of 6kB = O(BlogL) qubits per round as desired. 

As noted earlier, the server-model players will simulate A until A terminates. Then they can 
measure the workspace of nodes they own to check whether M is a 0- or 1-input of problem P. 
Observation 15. 3| implies that they can use this answer to answer whether G is a 0- or 1-input with 
the same error probability. Since each round of simulation requires a communication complexity 
of 0(B log L) and the simulation is done for T4 < Qeo^i (P(^0) rounds, the total communication 
complexity is 0((B log L)Q*^ ei (P(iV))) as claimed. 
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